[java-identity-provider] branch master updated: IDP-1523 - Split off secrets into separate property file

Scott Cantor cantor.2 at osu.edu
Thu Dec 19 12:25:55 EST 2019


This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=a9d7ef99fe81a661e39b7e47052492d69c42eb77

The following commit(s) were added to refs/heads/master by this push:
       new  a9d7ef9   IDP-1523 - Split off secrets into separate property file
a9d7ef9 is described below

commit a9d7ef99fe81a661e39b7e47052492d69c42eb77
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Dec 19 12:25:52 2019 -0500

    IDP-1523 - Split off secrets into separate property file
    
    https://issues.shibboleth.net/jira/browse/IDP-1523
    
    Moved identified properties into separate file.
---
 idp-conf/src/main/resources/conf/idp.properties         | 4 +---
 idp-conf/src/main/resources/conf/ldap.properties        | 2 --
 idp-conf/src/main/resources/conf/saml-nameid.properties | 4 +---
 3 files changed, 2 insertions(+), 8 deletions(-)

diff --git a/idp-conf/src/main/resources/conf/idp.properties b/idp-conf/src/main/resources/conf/idp.properties
index 1dab556..5480d17 100644
--- a/idp-conf/src/main/resources/conf/idp.properties
+++ b/idp-conf/src/main/resources/conf/idp.properties
@@ -1,5 +1,5 @@
 # Load any additional property resources from a comma-delimited list
-idp.additionalProperties = /conf/ldap.properties, /conf/saml-nameid.properties, /conf/services.properties, /conf/authn/duo.properties
+idp.additionalProperties = /conf/ldap.properties, /conf/saml-nameid.properties, /conf/services.properties, /conf/authn/duo.properties, /conf/secrets.properties
 
 # In most cases (and unless noted in the surrounding comments) the
 # commented settings in the distributed files document default behavior.
@@ -50,8 +50,6 @@ idp.csrf.enabled = true
 #idp.sealer.aliasBase = secret
 idp.sealer.storeResource = %{idp.home}/credentials/sealer.jks
 idp.sealer.versionResource = %{idp.home}/credentials/sealer.kver
-idp.sealer.storePassword = password
-idp.sealer.keyPassword = password
 
 # Settings for public/private signing and encryption key(s)
 # During decryption key rollover, point the ".2" properties at a second
diff --git a/idp-conf/src/main/resources/conf/ldap.properties b/idp-conf/src/main/resources/conf/ldap.properties
index c2bca67..50c5cfe 100644
--- a/idp-conf/src/main/resources/conf/ldap.properties
+++ b/idp-conf/src/main/resources/conf/ldap.properties
@@ -33,7 +33,6 @@ idp.authn.LDAP.userFilter                       = (uid={user})
 # bind search configuration
 # for AD: idp.authn.LDAP.bindDN=adminuser at domain.com
 idp.authn.LDAP.bindDN                           = uid=myservice,ou=system
-idp.authn.LDAP.bindDNCredential                 = myServicePassword
 
 # Format DN resolution, used by directAuthenticator, adAuthenticator
 # for AD use idp.authn.LDAP.dnFormat=%s at domain.com
@@ -46,7 +45,6 @@ idp.attribute.resolver.LDAP.connectTimeout      = %{idp.authn.LDAP.connectTimeou
 idp.attribute.resolver.LDAP.responseTimeout     = %{idp.authn.LDAP.responseTimeout:PT3S}
 idp.attribute.resolver.LDAP.baseDN              = %{idp.authn.LDAP.baseDN:undefined}
 idp.attribute.resolver.LDAP.bindDN              = %{idp.authn.LDAP.bindDN:undefined}
-idp.attribute.resolver.LDAP.bindDNCredential    = %{idp.authn.LDAP.bindDNCredential:undefined}
 idp.attribute.resolver.LDAP.useStartTLS         = %{idp.authn.LDAP.useStartTLS:true}
 idp.attribute.resolver.LDAP.trustCertificates   = %{idp.authn.LDAP.trustCertificates:undefined}
 idp.attribute.resolver.LDAP.searchFilter        = (uid=$resolutionContext.principal)
diff --git a/idp-conf/src/main/resources/conf/saml-nameid.properties b/idp-conf/src/main/resources/conf/saml-nameid.properties
index 85e20a0..7169c5e 100644
--- a/idp-conf/src/main/resources/conf/saml-nameid.properties
+++ b/idp-conf/src/main/resources/conf/saml-nameid.properties
@@ -14,12 +14,10 @@
 
 # Persistent IDs can be computed on the fly with a hash, or managed in a database
 
-# For computed IDs, set a source attribute and a secret salt:
+# For computed IDs, set a source attribute, and a secret salt in secrets.properties
 #idp.persistentId.sourceAttribute = changethistosomethingreal
 #idp.persistentId.useUnfilteredAttributes = true
-# Do *NOT* share the salt with other people, it's like divulging your private key.
 #idp.persistentId.algorithm = SHA
-#idp.persistentId.salt = changethistosomethingrandom
 # BASE64 will match V2 values, we recommend BASE32 encoding for new installs.
 idp.persistentId.encoding = BASE32
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the commits mailing list