[java-opensaml] branch master updated: OSJ-279 - give in-memory directory server a 2048-bit key

[Ian Young]

This is an automated email from the git hooks/post-receive script.

iay pushed a commit to branch master
in repository java-opensaml.

View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=f86854c9d69556047f7b0cc16bb2320fee23b622

The following commit(s) were added to refs/heads/master by this push:
       new  f86854c   OSJ-279 - give in-memory directory server a 2048-bit key
f86854c is described below

commit f86854c9d69556047f7b0cc16bb2320fee23b622
Author: Ian Young <ian at iay.org.uk>
AuthorDate: Wed Jul 24 15:55:16 2019 +0100

    OSJ-279 - give in-memory directory server a 2048-bit key
    
    https://issues.shibboleth.net/jira/browse/OSJ-279
    
    RHEL 8 introduces tighter policy applying to cryptographic algorithms, and in general prevents the use of RSA keys with moduli less than 2048 bits. Fix by revising the credentials for this in-memory LDAP server to use a 2048-bit key.
---
 .../org/opensaml/security/ldap/impl/README.md         |  14 ++++++++++++++
 .../org/opensaml/security/ldap/impl/test-ldap.key     |  11 +++++++----
 .../opensaml/security/ldap/impl/test-ldap.keystore    | Bin 1283 -> 2501 bytes
 3 files changed, 21 insertions(+), 4 deletions(-)

diff --git a/opensaml-security-impl/src/test/resources/org/opensaml/security/ldap/impl/README.md b/opensaml-security-impl/src/test/resources/org/opensaml/security/ldap/impl/README.md
new file mode 100644
index 0000000..22baeff
--- /dev/null
+++ b/opensaml-security-impl/src/test/resources/org/opensaml/security/ldap/impl/README.md
@@ -0,0 +1,14 @@
+# In-memory directory server
+
+This directory contains resources to construct an in-memory directory server
+for use in tests.
+
+* `test-ldap.keystore` contains a single `PrivateKeyEntry`
+    * created by `keytool -genkey -keyalg RSA -keystore test-ldap.keystore -storepass changeit -validity 3600 -keysize 2048 -dname CN=localhost,DC=shibboleth,DC=net`
+    * the keystore password is `changeit`
+    * the self-signed certificate is for `CN=localhost, DC=shibboleth, DC=net`
+    * the certificate's expiration date is set 10 years after creation
+* `test-ldap.key` is the 2018-bit RSA public key
+    * extract certificate: `keytool -keystore test-ldap.keystore -storepass changeit -exportcert -file temp.crt`
+    * extract key: `openssl x509 -inform der -in temp.crt -noout -pubkey >test-ldap.key`
+    * display using `openssl rsa -pubin -noout -text -in test-ldap.key`
diff --git a/opensaml-security-impl/src/test/resources/org/opensaml/security/ldap/impl/test-ldap.key b/opensaml-security-impl/src/test/resources/org/opensaml/security/ldap/impl/test-ldap.key
index 2b172fb..caa6875 100644
--- a/opensaml-security-impl/src/test/resources/org/opensaml/security/ldap/impl/test-ldap.key
+++ b/opensaml-security-impl/src/test/resources/org/opensaml/security/ldap/impl/test-ldap.key
@@ -1,6 +1,9 @@
 -----BEGIN PUBLIC KEY-----
-MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQD4+P5GTQWiysry100ksBJJt9EU
-QkN/Tj3xufC2ivvo843CRMuOebulpMwDLugYgBxy4F+fvXzeaWj/KHbbH7sV27Hg
-RK92nUVaXucaUEFZSstnNfDAbJsLSq/f8Ka9+S+brOHOBjtjJBiUD9EKNOT+lR+t
-doghorB34HaaIEOsNQIDAQAB
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAgK4BD3v9QQSXTXj8z1c1
+ZfRC/j5N7nKhDDIoN4uar1iqxXf+Ts44nFFPh5XMoIM6PFHEZrvaeKtYq0+QIsnP
+VLhOWfHyDCifXE+r6vcXGcWfsizG3kB71BIp5229vfzcKcaZKDenI9RQBuP9A5Nd
+6OkasknkNi25s7+svVSqMAIZK3oW+/SxelVH8GWzvCxC0Xd4m3Rl9LzynZrGDl7B
+/ZWaNZp5sqWpdFf4EImLzqlqjBpw3IQUAezrT7+Qm0lMKTqR+me9YsQPlwF75PrI
+RX8jreOD+ajdzW9QOIUV1tNnnsQEDX1IjmqkIslwt+048ZCn2x/8Iim3FD6EgiVi
+lQIDAQAB
 -----END PUBLIC KEY-----
diff --git a/opensaml-security-impl/src/test/resources/org/opensaml/security/ldap/impl/test-ldap.keystore b/opensaml-security-impl/src/test/resources/org/opensaml/security/ldap/impl/test-ldap.keystore
index 6125d1c..f0d704b 100644
Binary files a/opensaml-security-impl/src/test/resources/org/opensaml/security/ldap/impl/test-ldap.keystore and b/opensaml-security-impl/src/test/resources/org/opensaml/security/ldap/impl/test-ldap.keystore differ

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.