[java-identity-provider] branch master updated: OSJ-188: Enhance SignatureValidationFilter to make operation ...
Brent Putman
putmanb at georgetown.edu
Wed Aug 21 18:48:50 EDT 2019
This is an automated email from the git hooks/post-receive script.
putmanb pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=3c30197530da0cb3388b86baf5693b69d9d3149b
The following commit(s) were added to refs/heads/master by this push:
new 3c30197 OSJ-188: Enhance SignatureValidationFilter to make operation ...
3c30197 is described below
commit 3c30197530da0cb3388b86baf5693b69d9d3149b
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Wed Aug 21 18:46:33 2019 -0400
OSJ-188: Enhance SignatureValidationFilter to make operation ...
Schema and parser for new config flag 'alwaysVerifyTrustedSource'.
---
.../metadata/filter/impl/SignatureValidationParser.java | 5 +++++
.../metadata/filter/SignatureValidationParserTest.java | 16 ++++++++++++++++
.../metadata/filter/signature-config-custom.xml | 11 +++++++++++
.../metadata/filter/signature-config-defaults.xml | 9 +++++++++
.../src/main/resources/schema/shibboleth-metadata.xsd | 7 +++++++
5 files changed, 48 insertions(+)
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/impl/SignatureValidationParser.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/impl/SignatureValidationParser.java
index e9bfbe5..92aaf0d 100644
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/impl/SignatureValidationParser.java
+++ b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/impl/SignatureValidationParser.java
@@ -130,6 +130,11 @@ public class SignatureValidationParser extends AbstractSingleBeanDefinitionParse
SpringSupport.getStringValueAsBoolean(element.getAttributeNS(null, "requireSignedRoot")));
}
+ if (element.hasAttributeNS(null, "alwaysVerifyTrustedSource")) {
+ builder.addPropertyValue("alwaysVerifyTrustedSource",
+ SpringSupport.getStringValueAsBoolean(element.getAttributeNS(null, "alwaysVerifyTrustedSource")));
+ }
+
if (element.hasAttributeNS(null, "defaultCriteriaRef")) {
builder.addPropertyReference("defaultCriteria", element.getAttributeNS(null, "defaultCriteriaRef"));
} else {
diff --git a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/SignatureValidationParserTest.java b/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/SignatureValidationParserTest.java
index b6ffc7d..4231025 100644
--- a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/SignatureValidationParserTest.java
+++ b/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/SignatureValidationParserTest.java
@@ -115,5 +115,21 @@ public class SignatureValidationParserTest extends AbstractMetadataParserTest {
@Test(expectedExceptions={BeanDefinitionStoreException.class,}) public void none() throws IOException, ResolverException {
getBean(MetadataResolver.class, "filter/signingNone.xml", "beans.xml");
}
+
+ @Test public void configPropertiesDefaults() throws IOException {
+ SignatureValidationFilter filter =
+ getBean(SignatureValidationFilter.class, "filter/signature-config-defaults.xml", "filter/switch.xml", "beans.xml");
+
+ Assert.assertTrue(filter.getRequireSignedRoot());
+ Assert.assertFalse(filter.isAlwaysVerifyTrustedSource());
+ }
+ @Test public void configPropertiesCustom() throws IOException {
+ SignatureValidationFilter filter =
+ getBean(SignatureValidationFilter.class, "filter/signature-config-custom.xml", "filter/switch.xml", "beans.xml");
+
+ Assert.assertFalse(filter.getRequireSignedRoot());
+ Assert.assertTrue(filter.isAlwaysVerifyTrustedSource());
+ }
+
}
\ No newline at end of file
diff --git a/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/signature-config-custom.xml b/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/signature-config-custom.xml
new file mode 100644
index 0000000..8bce523
--- /dev/null
+++ b/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/signature-config-custom.xml
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<metadata:MetadataFilter
+ xmlns:metadata="urn:mace:shibboleth:2.0:metadata" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="urn:mace:shibboleth:2.0:metadata http://shibboleth.net/schema/idp/shibboleth-metadata.xsd
+ urn:oasis:names:tc:SAML:2.0:metadata http://docs.oasis-open.org/security/saml/v2.0/saml-schema-metadata-2.0.xsd"
+
+ xsi:type="metadata:SignatureValidation" trustEngineRef="bean.pem"
+ requireSignedRoot="false"
+ alwaysVerifyTrustedSource="true"
+/>
+
\ No newline at end of file
diff --git a/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/signature-config-defaults.xml b/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/signature-config-defaults.xml
new file mode 100644
index 0000000..741d9dd
--- /dev/null
+++ b/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/signature-config-defaults.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<metadata:MetadataFilter
+ xmlns:metadata="urn:mace:shibboleth:2.0:metadata" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="urn:mace:shibboleth:2.0:metadata http://shibboleth.net/schema/idp/shibboleth-metadata.xsd
+ urn:oasis:names:tc:SAML:2.0:metadata http://docs.oasis-open.org/security/saml/v2.0/saml-schema-metadata-2.0.xsd"
+
+ xsi:type="metadata:SignatureValidation" trustEngineRef="bean.pem"
+/>
+
\ No newline at end of file
diff --git a/idp-schema/src/main/resources/schema/shibboleth-metadata.xsd b/idp-schema/src/main/resources/schema/shibboleth-metadata.xsd
index b0a3274..7dde13f 100644
--- a/idp-schema/src/main/resources/schema/shibboleth-metadata.xsd
+++ b/idp-schema/src/main/resources/schema/shibboleth-metadata.xsd
@@ -887,6 +887,13 @@
</documentation>
</annotation>
</attribute>
+ <attribute name="alwaysVerifyTrustedSource" type="shibmd:string">
+ <annotation>
+ <documentation>
+ A boolean flag indicating whether the root signature of a trusted source should always be verified.
+ </documentation>
+ </annotation>
+ </attribute>
<attribute name="certificateFile" type="shibmd:string">
<annotation>
<documentation>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list