[java-identity-provider] 18/51: IDP-1121 Remove V2 metadata trust engines from security schema
Rod Widdowson
rdw at steadingsoftware.com
Wed Feb 6 08:42:49 EST 2019
This is an automated email from the git hooks/post-receive script.
rdw pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=2557ca90afac3fead4b2dde9a96e777d2d975ac6
commit 2557ca90afac3fead4b2dde9a96e777d2d975ac6
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Sun Dec 9 16:55:10 2018 +0000
IDP-1121 Remove V2 metadata trust engines from security schema
https://issues.shibboleth.net/jira/browse/IDP-1121
---
.../security/impl/SecurityNamespaceHandler.java | 11 ---
.../impl/UnsupportedTrustEngineParser.java | 82 -------------------
.../trustengine/SignatureChainingParserTest.java | 4 +-
.../spring/relyingparty/relying-party-group.xml | 3 +-
.../relyingparty/security/trustengine/chain.xml | 10 ++-
.../main/resources/schema/shibboleth-security.xsd | 95 ----------------------
6 files changed, 11 insertions(+), 194 deletions(-)
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/impl/SecurityNamespaceHandler.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/impl/SecurityNamespaceHandler.java
index 9ab8f84..9380d05 100644
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/impl/SecurityNamespaceHandler.java
+++ b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/impl/SecurityNamespaceHandler.java
@@ -35,7 +35,6 @@ import net.shibboleth.idp.profile.spring.relyingparty.security.trustengine.impl.
import net.shibboleth.idp.profile.spring.relyingparty.security.trustengine.impl.StaticExplicitKeySignatureParser;
import net.shibboleth.idp.profile.spring.relyingparty.security.trustengine.impl.StaticPKIXSignatureParser;
import net.shibboleth.idp.profile.spring.relyingparty.security.trustengine.impl.StaticPKIXX509CredentialParser;
-import net.shibboleth.idp.profile.spring.relyingparty.security.trustengine.impl.UnsupportedTrustEngineParser;
/** Namespace handler for {@link AbstractMetadataProviderParser#SECURITY_NAMESPACE}. */
public class SecurityNamespaceHandler extends BaseSpringNamespaceHandler {
@@ -71,16 +70,6 @@ public class SecurityNamespaceHandler extends BaseSpringNamespaceHandler {
registerBeanDefinitionParser(StaticPKIXSignatureParser.TYPE_NAME, new StaticPKIXSignatureParser());
registerBeanDefinitionParser(SignatureChainingParser.TYPE_NAME, new SignatureChainingParser());
- // Metadata based unsupported
- registerBeanDefinitionParser(UnsupportedTrustEngineParser.METADATA_EXPLICIT_KEY_TYPE,
- new UnsupportedTrustEngineParser());
- registerBeanDefinitionParser(UnsupportedTrustEngineParser.METADATA_EXPLICIT_KEY_SIGNATURE_TYPE,
- new UnsupportedTrustEngineParser());
- registerBeanDefinitionParser(UnsupportedTrustEngineParser.METADATA_PKIX_CREDENTIAL_TYPE,
- new UnsupportedTrustEngineParser());
- registerBeanDefinitionParser(UnsupportedTrustEngineParser.METADATA_PKIX_SIGNATURE_TYPE,
- new UnsupportedTrustEngineParser());
-
// Validation Info
registerBeanDefinitionParser(PKIXResourceValidationInfoParser.TYPE_NAME_FILESYSTEM,
new PKIXResourceValidationInfoParser());
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/UnsupportedTrustEngineParser.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/UnsupportedTrustEngineParser.java
deleted file mode 100644
index e6c2099..0000000
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/UnsupportedTrustEngineParser.java
+++ /dev/null
@@ -1,82 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.trustengine.impl;
-
-import javax.xml.namespace.QName;
-
-import net.shibboleth.idp.profile.spring.relyingparty.metadata.AbstractMetadataProviderParser;
-import net.shibboleth.utilities.java.support.primitive.DeprecationSupport;
-import net.shibboleth.utilities.java.support.primitive.DeprecationSupport.ObjectType;
-import net.shibboleth.utilities.java.support.xml.DOMTypeSupport;
-
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.springframework.beans.factory.support.BeanDefinitionBuilder;
-import org.springframework.beans.factory.xml.ParserContext;
-import org.w3c.dom.Element;
-
-/**
- * Parser for trust engines of types we no longer support.
- */
-public class UnsupportedTrustEngineParser extends AbstractTrustEngineParser {
-
- /** Schema type for MetadataPKIXSignature. */
- public static final QName METADATA_PKIX_SIGNATURE_TYPE = new QName(
- AbstractMetadataProviderParser.SECURITY_NAMESPACE, "MetadataPKIXSignature");
-
- /** Schema type for MetadataExplicitKeySignature. */
- public static final QName METADATA_EXPLICIT_KEY_SIGNATURE_TYPE = new QName(
- AbstractMetadataProviderParser.SECURITY_NAMESPACE, "MetadataExplicitKeySignature");
-
- /** Schema type for MetadataPKIXX509Credential. */
- public static final QName METADATA_PKIX_CREDENTIAL_TYPE = new QName(
- AbstractMetadataProviderParser.SECURITY_NAMESPACE, "MetadataPKIXX509Credential");
-
- /** Schema type for MetadataExplicitKey. */
- public static final QName METADATA_EXPLICIT_KEY_TYPE = new QName(AbstractMetadataProviderParser.SECURITY_NAMESPACE,
- "MetadataExplicitKey");
-
- /** Schema type for StaticPKIXX509Credential. */
- public static final QName PKIX_CREDENTIAL = new QName(AbstractMetadataProviderParser.SECURITY_NAMESPACE,
- "StaticPKIXX509Credential");
-
- /** Schema type for StaticPKIXX509Credential. */
- public static final QName STATIC_EXPLICIT_KEY_TYPE = new QName(AbstractMetadataProviderParser.SECURITY_NAMESPACE,
- "StaticExplicitKey");
-
- /** log. */
- private final Logger log = LoggerFactory.getLogger(UnsupportedTrustEngineParser.class);
-
- /** {@inheritDoc} */
- @Override protected Class<?> getBeanClass(final Element element) {
- return Object.class;
- }
-
- /** {@inheritDoc} */
- @Override protected void doParse(final Element element, final ParserContext parserContext,
- final BeanDefinitionBuilder builder) {
- super.doParse(element, parserContext, builder);
- DeprecationSupport.warn(ObjectType.ELEMENT, "Trust Engine type " +
- DOMTypeSupport.getXSIType(element).toString(),
- parserContext.getReaderContext().getResource().getDescription(),
- null);
- log.warn("Configuration {} contained unsupported Trust Engine type {}. This has been ignored.", parserContext
- .getReaderContext().getResource().getDescription(), DOMTypeSupport.getXSIType(element).toString());
- }
-
-}
diff --git a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/SignatureChainingParserTest.java b/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/SignatureChainingParserTest.java
index 05a9ce0..cf6f880 100644
--- a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/SignatureChainingParserTest.java
+++ b/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/SignatureChainingParserTest.java
@@ -38,9 +38,9 @@ public class SignatureChainingParserTest extends AbstractSecurityParserTest {
@Test public void simple() throws IOException, ResolverException {
final ChainingSignatureTrustEngine chain = getBean(ChainingSignatureTrustEngine.class, true, "trustengine/chain.xml");
- Assert.assertEquals(chain.getChain().size(),1 );
+ Assert.assertEquals(chain.getChain().size(),2);
- final TrustedCredentialTrustEngine engine = (TrustedCredentialTrustEngine) chain.getChain().get(0);
+ final TrustedCredentialTrustEngine engine = (TrustedCredentialTrustEngine) chain.getChain().get(1);
final StaticCredentialResolver resolver = (StaticCredentialResolver) engine.getCredentialResolver();
diff --git a/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/relying-party-group.xml b/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/relying-party-group.xml
index b72691a..2dbada7 100644
--- a/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/relying-party-group.xml
+++ b/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/relying-party-group.xml
@@ -125,6 +125,7 @@
evaluated by the trust engines and so you'll see some rules that reference
the declared trust engines. -->
+<!--
<security:TrustEngine id="shibboleth.SignatureTrustEngine"
xsi:type="security:SignatureChaining">
<security:TrustEngine
@@ -142,7 +143,7 @@
<security:TrustEngine id="shibboleth.CredentialMetadataPKIXTrustEngine"
xsi:type="security:MetadataPKIXX509Credential" metadataProviderRef="ShibbolethMetadata" />
</security:TrustEngine>
-
+-->
<security:SecurityPolicy id="shibboleth.ShibbolethSSOSecurityPolicy"
xsi:type="security:SecurityPolicyType">
<security:Rule xsi:type="samlsec:Replay" required="false" />
diff --git a/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/chain.xml b/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/chain.xml
index 04c461e..30154f5 100644
--- a/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/chain.xml
+++ b/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/chain.xml
@@ -4,9 +4,13 @@
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="urn:mace:shibboleth:2.0:security http://shibboleth.net/schema/idp/shibboleth-security.xsd"
xsi:type="security:SignatureChaining" id="Chain">
- <security:TrustEngine
- id="shibboleth.SignatureMetadataExplicitKeyTrustEngine" xsi:type="security:MetadataExplicitKeySignature"
- metadataProviderRef="ShibbolethMetadata" />
+ <security:TrustEngine id="testBean"
+ xsi:type="security:StaticPKIXSignature" xmlns:security="urn:mace:shibboleth:2.0:security"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="urn:mace:shibboleth:2.0:security http://shibboleth.net/schema/idp/shibboleth-security.xsd">
+ <security:ValidationInfo id="PKIXInline"
+ xsi:type="security:PKIXInline" />
+ </security:TrustEngine>
<security:TrustEngine id="testBean"
xsi:type="security:StaticExplicitKeySignature">
<security:Credential id="IdPCredential" xsi:type="security:X509Inline">
diff --git a/idp-schema/src/main/resources/schema/shibboleth-security.xsd b/idp-schema/src/main/resources/schema/shibboleth-security.xsd
index 7b6eec6..96c0674 100644
--- a/idp-schema/src/main/resources/schema/shibboleth-security.xsd
+++ b/idp-schema/src/main/resources/schema/shibboleth-security.xsd
@@ -482,101 +482,6 @@
</complexContent>
</complexType>
- <!-- Trust engines which use metadata provider-based resolvers -->
- <complexType name="MetadataExplicitKey">
- <annotation>
- <documentation>
- Trust engine used to validate a key against trusted keys obtained from metadata.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="sec:TrustEngineType">
- <attribute name="metadataProviderRef" type="string" use="required">
- <annotation>
- <documentation>
- The ID of the metadata provider used to look up trust information.
- </documentation>
- </annotation>
- </attribute>
- </extension>
- </complexContent>
- </complexType>
-
- <complexType name="MetadataPKIXX509Credential">
- <annotation>
- <documentation>
- Trust engine used to validate an X509 credential against PKIX information from metadata.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="sec:TrustEngineType">
- <sequence>
- <element ref="sec:ValidationOptions" minOccurs="0" maxOccurs="1">
- <annotation>
- <documentation>
- Set of options to influence PKIX trust validation processing.
- </documentation>
- </annotation>
- </element>
- </sequence>
- <attribute name="metadataProviderRef" type="string" use="required">
- <annotation>
- <documentation>
- The ID of the metadata provider used to look up trust information.
- </documentation>
- </annotation>
- </attribute>
- </extension>
- </complexContent>
- </complexType>
-
- <complexType name="MetadataExplicitKeySignature">
- <annotation>
- <documentation>
- Trust engine used to validate signatures with keys from metadata.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="sec:TrustEngineType">
- <attribute name="metadataProviderRef" type="string" use="required">
- <annotation>
- <documentation>
- The ID of the metadata provider used to look up trust information.
- </documentation>
- </annotation>
- </attribute>
- </extension>
- </complexContent>
- </complexType>
-
- <complexType name="MetadataPKIXSignature">
- <annotation>
- <documentation>
- Trust engine used to validate signatures with PKIX-validated certificates from metadata.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="sec:TrustEngineType">
- <sequence>
- <element ref="sec:ValidationOptions" minOccurs="0" maxOccurs="1">
- <annotation>
- <documentation>
- Set of options to influence PKIX trust validation processing.
- </documentation>
- </annotation>
- </element>
- </sequence>
- <attribute name="metadataProviderRef" type="string" use="required">
- <annotation>
- <documentation>
- The ID of the metadata provider used to look up trust information.
- </documentation>
- </annotation>
- </attribute>
- </extension>
- </complexContent>
- </complexType>
-
<!-- Trust engines which use resolvers configured via static information -->
<complexType name="StaticExplicitKey">
<annotation>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list