[java-identity-provider] branch master updated: IDP-1526 - Changes to profile and algorithm defaults

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=fa7696f8ff3daa13e25c6409a7a1a83f1535ca0f

The following commit(s) were added to refs/heads/master by this push:
       new  fa7696f   IDP-1526 - Changes to profile and algorithm defaults
fa7696f is described below

commit fa7696f8ff3daa13e25c6409a7a1a83f1535ca0f
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Dec 23 14:15:00 2019 -0500

    IDP-1526 - Changes to profile and algorithm defaults
    
    https://issues.shibboleth.net/jira/browse/IDP-1526
    
    Non-controversial changes.
---
 idp-conf/src/main/resources/conf/idp.properties    | 14 +++++++-------
 idp-conf/src/main/resources/conf/relying-party.xml |  5 +++++
 2 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/idp-conf/src/main/resources/conf/idp.properties b/idp-conf/src/main/resources/conf/idp.properties
index d56e0ff..cdba7c0 100644
--- a/idp-conf/src/main/resources/conf/idp.properties
+++ b/idp-conf/src/main/resources/conf/idp.properties
@@ -72,13 +72,13 @@ idp.encryption.cert = %{idp.home}/credentials/idp-encryption.crt
 #idp.encryption.config = shibboleth.EncryptionConfiguration.CBC
 
 # Configures trust evaluation of keys used by services at runtime
-# Defaults to supporting both explicit key and PKIX using SAML metadata.
-#idp.trust.signatures = shibboleth.ChainingSignatureTrustEngine
-# To pick only one set to one of:
-#   shibboleth.ExplicitKeySignatureTrustEngine, shibboleth.PKIXSignatureTrustEngine
-#idp.trust.certificates = shibboleth.ChainingX509TrustEngine
-# To pick only one set to one of:
-#   shibboleth.ExplicitKeyX509TrustEngine, shibboleth.PKIXX509TrustEngine
+# Internal default is Chaining, overriden for new installs
+idp.trust.signatures = shibboleth.ExplicitKeySignatureTrustEngine
+# Other options:
+#   shibboleth.ChainingSignatureTrustEngine, shibboleth.PKIXSignatureTrustEngine
+idp.trust.certificates = shibboleth.ExplicitKeyX509TrustEngine
+# Other options:
+#   shibboleth.ChainingX509TrustEngine, shibboleth.PKIXX509TrustEngine
 
 # If true, encryption will happen whenever a key to use can be located, but
 # failure to encrypt won't result in request failure.
diff --git a/idp-conf/src/main/resources/conf/relying-party.xml b/idp-conf/src/main/resources/conf/relying-party.xml
index 28c9193..5045b93 100644
--- a/idp-conf/src/main/resources/conf/relying-party.xml
+++ b/idp-conf/src/main/resources/conf/relying-party.xml
@@ -34,13 +34,18 @@
     <bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty">
         <property name="profileConfigurations">
             <list>
+                <!-- SAML 1.1 and SAML 2.0 AttributeQuery are disabled by default. -->
+                <!--
                 <bean parent="Shibboleth.SSO" p:postAuthenticationFlows="attribute-release" />
                 <ref bean="SAML1.AttributeQuery" />
                 <ref bean="SAML1.ArtifactResolution" />
+                -->
                 <bean parent="SAML2.SSO" p:postAuthenticationFlows="attribute-release" />
                 <ref bean="SAML2.ECP" />
                 <ref bean="SAML2.Logout" />
+                <!--
                 <ref bean="SAML2.AttributeQuery" />
+                -->
                 <ref bean="SAML2.ArtifactResolution" />
                 <ref bean="Liberty.SSOS" />
             </list>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.