[java-identity-provider] 19/51: IDP-1375 Remove rules and other Non V3 config from sec: namespace
Rod Widdowson
rdw at steadingsoftware.com
Wed Feb 6 08:42:50 EST 2019
This is an automated email from the git hooks/post-receive script.
rdw pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=a1d7412c04f84405f61ea54d661b7f2bda7e6476
commit a1d7412c04f84405f61ea54d661b7f2bda7e6476
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Mon Dec 10 17:00:48 2018 +0000
IDP-1375 Remove rules and other Non V3 config from sec: namespace
https://issues.shibboleth.net/jira/browse/IDP-1375
---
.../relyingparty/impl/RelyingPartyGroupParser.java | 10 --
.../security/impl/SecurityNamespaceHandler.java | 4 -
.../spring/relyingparty/relying-party-group.xml | 4 +-
.../resources/schema/shibboleth-relying-party.xsd | 1 -
.../schema/shibboleth-security-policy-saml.xsd | 157 ---------------------
.../main/resources/schema/shibboleth-security.xsd | 60 --------
6 files changed, 2 insertions(+), 234 deletions(-)
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/impl/RelyingPartyGroupParser.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/impl/RelyingPartyGroupParser.java
index dcc164d..827dc26 100644
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/impl/RelyingPartyGroupParser.java
+++ b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/impl/RelyingPartyGroupParser.java
@@ -53,9 +53,6 @@ import org.w3c.dom.Element;
*/
public class RelyingPartyGroupParser extends AbstractSingleBeanDefinitionParser {
- /** Logger. */
- private final Logger log = LoggerFactory.getLogger(RelyingPartyGroupParser.class);
-
/** {@inheritDoc} */
@Override protected Class<DefaultRelyingPartyConfigurationResolver> getBeanClass(final Element element) {
return DefaultRelyingPartyConfigurationResolver.class;
@@ -107,13 +104,6 @@ public class RelyingPartyGroupParser extends AbstractSingleBeanDefinitionParser
SpringSupport.parseCustomElements(configChildren.get(AbstractMetadataProviderParser.TRUST_ENGINE_ELEMENT_NAME),
parserContext);
- // <SecurityPolicy> (warn and ignore).
- final List<Element> policies = configChildren.get(SecurityNamespaceHandler.SECURITY_POLICY_NAME);
- if (null != policies && !policies.isEmpty()) {
- log.warn("{}: {} occurrence(s) of unsupported <SecurityPolicy/> elements have been ignored", parserContext
- .getReaderContext().getResource().getDescription(), policies.size());
- }
-
}
/** {@inheritDoc} */
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/impl/SecurityNamespaceHandler.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/impl/SecurityNamespaceHandler.java
index 9380d05..f2fbad8 100644
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/impl/SecurityNamespaceHandler.java
+++ b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/impl/SecurityNamespaceHandler.java
@@ -43,10 +43,6 @@ public class SecurityNamespaceHandler extends BaseSpringNamespaceHandler {
public static final QName CREDENTIAL_ELEMENT_NAME = new QName(AbstractMetadataProviderParser.SECURITY_NAMESPACE,
"Credential");
- /** SecurityPolicy element name. */
- public static final QName SECURITY_POLICY_NAME = new QName(AbstractMetadataProviderParser.SECURITY_NAMESPACE,
- "SecurityPolicy");
-
/** TrustEngineRef element name. */
public static final QName TRUST_ENGINE_REF = new QName(AbstractMetadataProviderParser.SECURITY_NAMESPACE,
"TrustEngineRef");
diff --git a/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/relying-party-group.xml b/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/relying-party-group.xml
index 2dbada7..252d5e0 100644
--- a/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/relying-party-group.xml
+++ b/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/relying-party-group.xml
@@ -143,7 +143,7 @@
<security:TrustEngine id="shibboleth.CredentialMetadataPKIXTrustEngine"
xsi:type="security:MetadataPKIXX509Credential" metadataProviderRef="ShibbolethMetadata" />
</security:TrustEngine>
--->
+
<security:SecurityPolicy id="shibboleth.ShibbolethSSOSecurityPolicy"
xsi:type="security:SecurityPolicyType">
<security:Rule xsi:type="samlsec:Replay" required="false" />
@@ -236,5 +236,5 @@
<security:Rule xsi:type="samlsec:MandatoryIssuer" />
<security:Rule xsi:type="security:MandatoryMessageAuthentication" />
</security:SecurityPolicy>
-
+-->
</rp:RelyingPartyGroup>
diff --git a/idp-schema/src/main/resources/schema/shibboleth-relying-party.xsd b/idp-schema/src/main/resources/schema/shibboleth-relying-party.xsd
index 784699e..d63b869 100644
--- a/idp-schema/src/main/resources/schema/shibboleth-relying-party.xsd
+++ b/idp-schema/src/main/resources/schema/shibboleth-relying-party.xsd
@@ -21,7 +21,6 @@
<element ref="shibmd:MetadataProvider" minOccurs="0"/>
<element ref="security:Credential" minOccurs="0" maxOccurs="unbounded"/>
<element ref="security:TrustEngine" minOccurs="0" maxOccurs="unbounded"/>
- <element ref="security:SecurityPolicy" minOccurs="0" maxOccurs="unbounded"/>
</sequence>
</complexType>
</element>
diff --git a/idp-schema/src/main/resources/schema/shibboleth-security-policy-saml.xsd b/idp-schema/src/main/resources/schema/shibboleth-security-policy-saml.xsd
deleted file mode 100644
index c54abdc..0000000
--- a/idp-schema/src/main/resources/schema/shibboleth-security-policy-saml.xsd
+++ /dev/null
@@ -1,157 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<schema xmlns="http://www.w3.org/2001/XMLSchema" xmlns:samlsec="urn:mace:shibboleth:2.0:security:saml" xmlns:sec="urn:mace:shibboleth:2.0:security" targetNamespace="urn:mace:shibboleth:2.0:security:saml" elementFormDefault="qualified">
-
- <import namespace="urn:mace:shibboleth:2.0:security" schemaLocation="http://shibboleth.net/schema/idp/shibboleth-security.xsd"/>
-
- <complexType name="ProtocolWithXMLSignature">
- <annotation>
- <documentation>
- A rule that checks the signature on SAML protocol messages.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="sec:SecurityPolicyRuleType">
- <attribute name="trustEngineRef" type="string" use="required">
- <annotation>
- <documentation>
- Reference to the trust engine used to validate the signature.
- </documentation>
- </annotation>
- </attribute>
- </extension>
- </complexContent>
- </complexType>
-
- <complexType name="SAML2AuthnRequestsSigned">
- <annotation>
- <documentation>
- A rule that requires that an incoming SAML 2 AuthnRequest be signed
- if this requirement is indicated in metadata via the request issuer's
- SPSSODescriptor AuthnRequestsSigned attribute value.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="sec:SecurityPolicyRuleType"/>
- </complexContent>
- </complexType>
-
- <complexType name="SAML2HTTPPostSimpleSign">
- <annotation>
- <documentation>
- A rule that checks the signature on SAML protocol messages.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="sec:SecurityPolicyRuleType">
- <attribute name="trustEngineRef" type="string" use="required">
- <annotation>
- <documentation>
- Reference to the trust engine used to validate the signature.
- </documentation>
- </annotation>
- </attribute>
- <attribute name="parserPoolRef" type="string" default="shibboleth.ParserPool">
- <annotation>
- <documentation>
- Reference to the parser pool used to parse incoming XML message.
- </documentation>
- </annotation>
- </attribute>
- </extension>
- </complexContent>
- </complexType>
-
- <complexType name="SAML2HTTPRedirectSimpleSign">
- <annotation>
- <documentation>
- A rule that checks the signature on SAML protocol messages.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="sec:SecurityPolicyRuleType">
- <attribute name="trustEngineRef" type="string" use="required">
- <annotation>
- <documentation>
- Reference to the trust engine used to validate the signature.
- </documentation>
- </annotation>
- </attribute>
- </extension>
- </complexContent>
- </complexType>
-
- <complexType name="MandatoryIssuer">
- <annotation>
- <documentation>
- A rule that requires that the issuer of the inbound SAML message, within the message context, be
- populated.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="sec:SecurityPolicyRuleType"/>
- </complexContent>
- </complexType>
-
- <complexType name="IssueInstant">
- <annotation>
- <documentation>
- A rule that inspects the message issue instant and ensures that it is within a certain timeframe.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="sec:SecurityPolicyRuleType">
- <attribute name="expirationThreshold" type="string">
- <annotation>
- <documentation>
- Time after a message is issued before it is considered expired.
-
- Threshold is expressed in ISO8601 duration notation.
- </documentation>
- </annotation>
- </attribute>
- <attribute name="clockSkew" type="string">
- <annotation>
- <documentation>
- Defines the valid life time of a message issue instant as: (instant - skew) < now >
- (instant + expirationThreshold + skew)
-
- Skew is expressed in ISO8601 duration notation.
- </documentation>
- </annotation>
- </attribute>
- <attribute name="required" type="string">
- <annotation>
- <documentation>
- A boolean flag indicating whether this rule is required to be evaluated.
- </documentation>
- </annotation>
- </attribute>
- </extension>
- </complexContent>
- </complexType>
-
- <complexType name="Replay">
- <annotation>
- <documentation>
- A security policy rule that ensure a received SAML message has not already been processed.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="sec:SecurityPolicyRuleType">
- <attribute name="replayCacheRef" type="string" default="shibboleth.ReplayCache">
- <annotation>
- <documentation>Name of the replay cache to use.</documentation>
- </annotation>
- </attribute>
- <attribute name="required" type="string">
- <annotation>
- <documentation>
- A boolean flag indicating whether this rule is required to be evaluated.
- </documentation>
- </annotation>
- </attribute>
- </extension>
- </complexContent>
- </complexType>
-
-</schema>
diff --git a/idp-schema/src/main/resources/schema/shibboleth-security.xsd b/idp-schema/src/main/resources/schema/shibboleth-security.xsd
index 96c0674..1fb16f1 100644
--- a/idp-schema/src/main/resources/schema/shibboleth-security.xsd
+++ b/idp-schema/src/main/resources/schema/shibboleth-security.xsd
@@ -645,64 +645,4 @@
</attribute>
</complexType>
- <!-- SECURITY POLICY RELATED OBJECTS -->
- <element name="SecurityPolicy" type="sec:SecurityPolicyType"/>
- <complexType name="SecurityPolicyType">
- <annotation>
- <documentation>
- Security policies define a set of rules that are evaluated against incoming messages to
- determine whether the messages should be processed.
- </documentation>
- </annotation>
- <sequence>
- <element ref="sec:Rule" minOccurs="0" maxOccurs="unbounded"/>
- </sequence>
- <attribute name="id" type="string" use="required">
- <annotation>
- <documentation>
- A unique ID for the policy.
- </documentation>
- </annotation>
- </attribute>
- </complexType>
-
- <element name="Rule" type="sec:SecurityPolicyRuleType"/>
-
- <complexType name="MandatoryMessageAuthentication">
- <annotation>
- <documentation>
- A security rule that requires that an incoming message be authenticated.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="sec:SecurityPolicyRuleType"/>
- </complexContent>
- </complexType>
-
- <complexType name="ClientCertAuth">
- <annotation>
- <documentation>
- A security rule that validates a client certificate, available from the inbound transport, with a trust engine.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="sec:SecurityPolicyRuleType">
- <attribute name="trustEngineRef" type="string" use="required">
- <annotation>
- <documentation>
- Reference to the trust engine used to validate the signature.
- </documentation>
- </annotation>
- </attribute>
- </extension>
- </complexContent>
- </complexType>
-
- <complexType name="SecurityPolicyRuleType" abstract="true">
- <annotation>
- <documentation>
- Base type of security policy rules.
- </documentation>
- </annotation>
- </complexType>
</schema>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list