[java-identity-provider] branch master updated: Some code cleanup, moving bulk of LDAP defs into flow bean file.
Scott Cantor
cantor.2 at osu.edu
Thu Dec 5 09:40:22 EST 2019
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=884ea82c193c2c7608ed70d45b17933406269353
The following commit(s) were added to refs/heads/master by this push:
new 884ea82 Some code cleanup, moving bulk of LDAP defs into flow bean file.
884ea82 is described below
commit 884ea82c193c2c7608ed70d45b17933406269353
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Dec 5 09:40:19 2019 -0500
Some code cleanup, moving bulk of LDAP defs into flow bean file.
---
.../config/LDAPAuthenticationFactoryBean.java | 33 +++++++++------
.../resources/conf/authn/ldap-authn-config.xml | 48 +++++++---------------
.../system/flows/authn/password-authn-beans.xml | 33 ++++++++++++++-
3 files changed, 67 insertions(+), 47 deletions(-)
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/LDAPAuthenticationFactoryBean.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/LDAPAuthenticationFactoryBean.java
index 2636d45..e3c0ac9 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/LDAPAuthenticationFactoryBean.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/LDAPAuthenticationFactoryBean.java
@@ -24,6 +24,10 @@ import java.util.List;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import net.shibboleth.idp.authn.PooledTemplateSearchDnResolver;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.primitive.DeprecationSupport;
+import net.shibboleth.utilities.java.support.primitive.DeprecationSupport.ObjectType;
+
import org.apache.velocity.app.VelocityEngine;
import org.ldaptive.BindConnectionInitializer;
import org.ldaptive.ConnectionConfig;
@@ -200,15 +204,15 @@ public class LDAPAuthenticationFactoryBean extends AbstractFactoryBean<Authentic
/** Whether to use account state data as defined by the EDirectory schema. */
private boolean isEDirectory;
- public void setAuthenticatorType(final String type) {
+ public void setAuthenticatorType(@Nonnull @NotEmpty final String type) {
authenticatorType = AuthenticatorType.fromLabel(type);
}
- public void setTrustType(final String type) {
+ public void setTrustType(@Nonnull @NotEmpty final String type) {
trustType = TrustType.fromLabel(type);
}
- public void setLdapUrl(final String url) {
+ public void setLdapUrl(@Nullable @NotEmpty final String url) {
ldapUrl = url;
}
@@ -220,11 +224,11 @@ public class LDAPAuthenticationFactoryBean extends AbstractFactoryBean<Authentic
useSSL = b;
}
- public void setConnectTimeout(final Duration timeout) {
+ public void setConnectTimeout(@Nullable final Duration timeout) {
connectTimeout = timeout;
}
- public void setResponseTimeout(final Duration timeout) {
+ public void setResponseTimeout(@Nullable final Duration timeout) {
responseTimeout = timeout;
}
@@ -236,7 +240,7 @@ public class LDAPAuthenticationFactoryBean extends AbstractFactoryBean<Authentic
truststoreCredentialConfig = config;
}
- public void setBlockWaitTime(final Duration time) {
+ public void setBlockWaitTime(@Nullable final Duration time) {
blockWaitTime = time;
}
@@ -256,15 +260,15 @@ public class LDAPAuthenticationFactoryBean extends AbstractFactoryBean<Authentic
validatePeriodically = b;
}
- public void setValidatePeriod(final Duration period) {
+ public void setValidatePeriod(@Nullable final Duration period) {
validatePeriod = period;
}
- public void setPrunePeriod(final Duration period) {
+ public void setPrunePeriod(@Nullable final Duration period) {
prunePeriod = period;
}
- public void setIdleTime(final Duration time) {
+ public void setIdleTime(@Nullable final Duration time) {
idleTime = time;
}
@@ -374,8 +378,7 @@ public class LDAPAuthenticationFactoryBean extends AbstractFactoryBean<Authentic
*
* @return new blocking connection pool
*/
- protected BlockingConnectionPool createConnectionPool(final String name, final ConnectionConfig config)
- {
+ protected BlockingConnectionPool createConnectionPool(final String name, final ConnectionConfig config) {
final PoolConfig poolConfig = new PoolConfig();
poolConfig.setMinPoolSize(minPoolSize);
poolConfig.setMaxPoolSize(maxPoolSize);
@@ -394,13 +397,15 @@ public class LDAPAuthenticationFactoryBean extends AbstractFactoryBean<Authentic
return pool;
}
+// Checkstyle: CyclomaticComplexity|MethodLength OFF
@Override
protected Authenticator createInstance() throws Exception {
// check for deprecated useSSL property
if (useSSL) {
- log.warn("The useSSL property is deprecated, specify the use of LDAPS in your URL by using the ldaps:// scheme.");
+ DeprecationSupport.warn(ObjectType.PROPERTY, "useSSL", "LDAP authentication",
+ "use of ldaps:// scheme in connection URL");
final LdapURL url = new LdapURL(ldapUrl);
- for (String s : url.getHostnamesWithSchemeAndPort()) {
+ for (final String s : url.getHostnamesWithSchemeAndPort()) {
if (!s.startsWith("ldaps://")) {
throw new IllegalArgumentException("useSSL property specified but URL scheme is not ldaps:// for " + s);
}
@@ -445,6 +450,7 @@ public class LDAPAuthenticationFactoryBean extends AbstractFactoryBean<Authentic
createConnectionConfig())));
authenticator.setDnResolver(anonSearchDnResolver);
authenticator.setResolveEntryOnFailure(resolveEntryOnFailure);
+ break;
default:
break;
}
@@ -466,6 +472,7 @@ public class LDAPAuthenticationFactoryBean extends AbstractFactoryBean<Authentic
}
return authenticator;
}
+// Checkstyle: CyclomaticComplexity|MethodLength ON
@Override
public Class<?> getObjectType() {
diff --git a/idp-conf/src/main/resources/conf/authn/ldap-authn-config.xml b/idp-conf/src/main/resources/conf/authn/ldap-authn-config.xml
index ebe0d76..22824d0 100644
--- a/idp-conf/src/main/resources/conf/authn/ldap-authn-config.xml
+++ b/idp-conf/src/main/resources/conf/authn/ldap-authn-config.xml
@@ -9,42 +9,24 @@
default-destroy-method="destroy"
default-lazy-init="true">
+ <!--
+ Default behavior is to rely on properties to populate the various beans.
+ You can override these, particularly shibboleth.authn.LDAP.authenticator,
+ to customize the settings or avoid use of properties.
+
+ Be cautious of any direct dependency on ldaptive classes to simplify upgrades.
+ -->
+
<bean id="shibboleth.authn.LDAP.returnAttributes" parent="shibboleth.CommaDelimStringArray">
<constructor-arg type="java.lang.String" value="%{idp.authn.LDAP.returnAttributes:1.1}" />
</bean>
- <bean id="shibboleth.authn.LDAP.trustCertificates" parent="shibboleth.X509ResourceCredentialConfig" p:trustCertificates="%{idp.authn.LDAP.trustCertificates:undefined}" />
- <bean id="shibboleth.authn.LDAP.truststore" parent="shibboleth.KeystoreResourceCredentialConfig" p:truststore="%{idp.authn.LDAP.trustStore:undefined}" />
-
- <bean id="shibboleth.authn.LDAP.authenticator" class="net.shibboleth.idp.authn.config.LDAPAuthenticationFactoryBean"
- p:authenticatorType="%{idp.authn.LDAP.authenticator:anonSearchAuthenticator}"
- p:trustType="%{idp.authn.LDAP.sslConfig:certificateTrust}"
- p:ldapUrl="%{idp.authn.LDAP.ldapURL}"
- p:useStartTLS="%{idp.authn.LDAP.useStartTLS:true}"
- p:connectTimeout="%{idp.authn.LDAP.connectTimeout:PT3S}"
- p:responseTimeout="%{idp.authn.LDAP.responseTimeout:PT3S}"
- p:trustCertificatesCredentialConfig-ref="shibboleth.authn.LDAP.trustCertificates"
- p:truststoreCredentialConfig-ref="shibboleth.authn.LDAP.truststore"
- p:blockWaitTime="%{idp.pool.LDAP.blockWaitTime:PT3S}"
- p:minPoolSize="%{idp.pool.LDAP.minSize:3}"
- p:maxPoolSize="%{idp.pool.LDAP.maxSize:10}"
- p:validateOnCheckout="%{idp.pool.LDAP.validateOnCheckout:false}"
- p:validatePeriodically="%{idp.pool.LDAP.validatePeriodically:true}"
- p:validatePeriod="%{idp.pool.LDAP.validatePeriod:PT5M}"
- p:prunePeriod="%{idp.pool.LDAP.prunePeriod:PT5M}"
- p:idleTime="%{idp.pool.LDAP.idleTime:PT10M}"
- p:dnFormat="%{idp.authn.LDAP.dnFormat:undefined}"
- p:baseDn="#{'%{idp.authn.LDAP.baseDN:undefined}'.trim()}"
- p:userFilter="#{'%{idp.authn.LDAP.userFilter:undefined}'.trim()}"
- p:subtreeSearch="%{idp.authn.LDAP.subtreeSearch:false}"
- p:resolveEntryOnFailure="%{idp.authn.LDAP.resolveEntryOnFailure:false}"
- p:velocityEngine-ref="shibboleth.VelocityEngine"
- p:bindDn="#{'%{idp.authn.LDAP.bindDN:undefined}'.trim()}"
- p:bindDnCredential="%{idp.authn.LDAP.bindDNCredential:undefined}"
- p:usePasswordPolicy="%{idp.authn.LDAP.usePasswordPolicy:false}"
- p:usePasswordExpiration="%{idp.authn.LDAP.usePasswordExpiration:false}"
- p:freeIPA="%{idp.authn.LDAP.freeIPADirectory:false}"
- p:EDirectory="%{idp.authn.LDAP.eDirectory:false}"
- />
+ <bean id="shibboleth.authn.LDAP.trustCertificates" parent="shibboleth.X509ResourceCredentialConfig"
+ p:trustCertificates="%{idp.authn.LDAP.trustCertificates:undefined}" />
+
+ <bean id="shibboleth.authn.LDAP.truststore" parent="shibboleth.KeystoreResourceCredentialConfig"
+ p:truststore="%{idp.authn.LDAP.trustStore:undefined}" />
+
+ <bean id="shibboleth.authn.LDAP.authenticator" parent="shibboleth.LDAPAuthenticationFactory" />
</beans>
diff --git a/idp-conf/src/main/resources/system/flows/authn/password-authn-beans.xml b/idp-conf/src/main/resources/system/flows/authn/password-authn-beans.xml
index 83bcae9..b11187f 100644
--- a/idp-conf/src/main/resources/system/flows/authn/password-authn-beans.xml
+++ b/idp-conf/src/main/resources/system/flows/authn/password-authn-beans.xml
@@ -107,8 +107,39 @@
p:authenticator-ref="shibboleth.authn.LDAP.authenticator"
p:returnAttributes-ref="shibboleth.authn.LDAP.returnAttributes" />
- <!-- Parent beans for custom ldaptive CredentialConfig types. -->
+ <!-- Parent beans for custom ldaptive types. -->
+ <bean id="shibboleth.LDAPAuthenticationFactory" abstract="true"
+ class="net.shibboleth.idp.authn.config.LDAPAuthenticationFactoryBean"
+ p:authenticatorType="%{idp.authn.LDAP.authenticator:anonSearchAuthenticator}"
+ p:trustType="%{idp.authn.LDAP.sslConfig:certificateTrust}"
+ p:ldapUrl="%{idp.authn.LDAP.ldapURL}"
+ p:useStartTLS="%{idp.authn.LDAP.useStartTLS:true}"
+ p:connectTimeout="%{idp.authn.LDAP.connectTimeout:PT3S}"
+ p:responseTimeout="%{idp.authn.LDAP.responseTimeout:PT3S}"
+ p:trustCertificatesCredentialConfig-ref="shibboleth.authn.LDAP.trustCertificates"
+ p:truststoreCredentialConfig-ref="shibboleth.authn.LDAP.truststore"
+ p:blockWaitTime="%{idp.pool.LDAP.blockWaitTime:PT3S}"
+ p:minPoolSize="%{idp.pool.LDAP.minSize:3}"
+ p:maxPoolSize="%{idp.pool.LDAP.maxSize:10}"
+ p:validateOnCheckout="%{idp.pool.LDAP.validateOnCheckout:false}"
+ p:validatePeriodically="%{idp.pool.LDAP.validatePeriodically:true}"
+ p:validatePeriod="%{idp.pool.LDAP.validatePeriod:PT5M}"
+ p:prunePeriod="%{idp.pool.LDAP.prunePeriod:PT5M}"
+ p:idleTime="%{idp.pool.LDAP.idleTime:PT10M}"
+ p:dnFormat="%{idp.authn.LDAP.dnFormat:undefined}"
+ p:baseDn="#{'%{idp.authn.LDAP.baseDN:undefined}'.trim()}"
+ p:userFilter="#{'%{idp.authn.LDAP.userFilter:undefined}'.trim()}"
+ p:subtreeSearch="%{idp.authn.LDAP.subtreeSearch:false}"
+ p:resolveEntryOnFailure="%{idp.authn.LDAP.resolveEntryOnFailure:false}"
+ p:velocityEngine-ref="shibboleth.VelocityEngine"
+ p:bindDn="#{'%{idp.authn.LDAP.bindDN:undefined}'.trim()}"
+ p:bindDnCredential="%{idp.authn.LDAP.bindDNCredential:undefined}"
+ p:usePasswordPolicy="%{idp.authn.LDAP.usePasswordPolicy:false}"
+ p:usePasswordExpiration="%{idp.authn.LDAP.usePasswordExpiration:false}"
+ p:freeIPA="%{idp.authn.LDAP.freeIPADirectory:false}"
+ p:EDirectory="%{idp.authn.LDAP.eDirectory:false}" />
+
<bean id="shibboleth.X509ResourceCredentialConfig"
class="net.shibboleth.idp.authn.impl.X509ResourceCredentialConfig" abstract="true" />
<bean id="shibboleth.KeystoreResourceCredentialConfig"
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list