[java-identity-provider] 01/04: Implement message channel security support for SOAP client case

[Brent Putman]

This is an automated email from the git hooks/post-receive script.

putmanb pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=d538fb60928e3809ed8bcc054f1a43ddfce886ef

commit d538fb60928e3809ed8bcc054f1a43ddfce886ef
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Wed Sep 26 21:18:10 2018 -0400

    Implement message channel security support for SOAP client case
---
 idp-conf/src/main/resources/system/conf/soap-client.xml          | 9 +++++++++
 .../config/AbstractSAML2ArtifactAwareProfileConfiguration.java   | 5 +++--
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/idp-conf/src/main/resources/system/conf/soap-client.xml b/idp-conf/src/main/resources/system/conf/soap-client.xml
index aab460d..c61d911 100644
--- a/idp-conf/src/main/resources/system/conf/soap-client.xml
+++ b/idp-conf/src/main/resources/system/conf/soap-client.xml
@@ -59,6 +59,8 @@
                 <property name="handlers">
                     <util:list>
                     
+                        <ref bean="SOAPClient.MessageChannelSecurity" />
+                        
                         <ref bean="SOAPClient.InitializeRelyingPartyContexFromSAMLPeer" />
                         
                         <ref bean="SOAPClient.SelectRelyingPartyConfiguration" />
@@ -152,6 +154,9 @@
     <bean id="SOAPClient.SAMLMessageContextIssuerFunction"
         class="org.opensaml.saml.common.messaging.context.navigate.SAMLMessageContextIssuerFunction" />
     
+    <bean id="SOAPClient.DestinationURILookup" 
+        class="org.opensaml.soap.client.messaging.SOAPClientDestinationURILookup" />
+    
     <bean id="SOAPClient.SignArtifactRequestsPredicate" 
         class="net.shibboleth.idp.saml.profile.config.logic.messaging.SignArtifactRequestsPredicate" />
     
@@ -172,6 +177,10 @@
         class="net.shibboleth.idp.profile.messaging.impl.SelectProfileConfiguration" scope="prototype"
         p:profiledIdLookupStrategy-ref="SOAPClient.SOAPClientSecurityProfileIdLookup" />
         
+    <bean id="SOAPClient.MessageChannelSecurity"
+        class="org.opensaml.messaging.handler.impl.URLEvaluatingMessageChannelSecurity" scope="prototype"
+        p:URLLookup-ref="SOAPClient.DestinationURILookup" />
+        
     <bean id="SOAPClient.HttpClient" parent="shibboleth.NonCachingHttpClient"
         p:tLSSocketFactory-ref="shibboleth.SecurityEnhancedTLSSocketFactoryWithClientTLS" />
     
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2ArtifactAwareProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2ArtifactAwareProfileConfiguration.java
index 290abae..4b0a16d 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2ArtifactAwareProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2ArtifactAwareProfileConfiguration.java
@@ -25,6 +25,7 @@ import com.google.common.base.Predicate;
 import com.google.common.base.Predicates;
 
 import org.opensaml.messaging.context.MessageContext;
+import org.opensaml.messaging.logic.NoIntegrityMessageChannelPredicate;
 import org.opensaml.profile.context.ProfileRequestContext;
 
 import net.shibboleth.idp.saml.profile.config.SAMLArtifactAwareProfileConfiguration;
@@ -60,8 +61,8 @@ public abstract class AbstractSAML2ArtifactAwareProfileConfiguration
     protected AbstractSAML2ArtifactAwareProfileConfiguration(@Nonnull @NotEmpty final String profileId) {
         super(profileId);
         artifactConfigurationLookupStrategy = FunctionSupport.constant(null);
-        signArtifactRequestsPredicate = Predicates.alwaysFalse();
-        clientTLSArtifactRequestsPredicate = Predicates.alwaysFalse();
+        signArtifactRequestsPredicate = new NoIntegrityMessageChannelPredicate();
+        clientTLSArtifactRequestsPredicate = Predicates.not(new NoIntegrityMessageChannelPredicate());
     }
     
     /** {@inheritDoc} */

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.