[java-identity-provider] branch master updated: JSPT-87 - Scriptable DataSealerKeyStrategy

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=c235024c26e507a36baa12cbca1e1ba70da04636

The following commit(s) were added to refs/heads/master by this push:
       new  c235024   JSPT-87 - Scriptable DataSealerKeyStrategy
c235024 is described below

commit c235024c26e507a36baa12cbca1e1ba70da04636
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed May 22 17:51:44 2019 -0400

    JSPT-87 - Scriptable DataSealerKeyStrategy
    
    Allow key strategy bean to be overridden by property.
---
 idp-conf/src/main/resources/conf/idp.properties           | 1 +
 idp-conf/src/main/resources/system/conf/global-system.xml | 6 +++---
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/idp-conf/src/main/resources/conf/idp.properties b/idp-conf/src/main/resources/conf/idp.properties
index e633f07..2baae46 100644
--- a/idp-conf/src/main/resources/conf/idp.properties
+++ b/idp-conf/src/main/resources/conf/idp.properties
@@ -40,6 +40,7 @@ idp.scope = example.org
 #idp.views = %{idp.home}/views
 
 # Settings for internal AES encryption key
+#idp.sealer.keyStrategy = shibboleth.DataSealerKeyStrategy
 #idp.sealer.storeType = JCEKS
 #idp.sealer.updateInterval = PT15M
 #idp.sealer.aliasBase = secret
diff --git a/idp-conf/src/main/resources/system/conf/global-system.xml b/idp-conf/src/main/resources/system/conf/global-system.xml
index 7f46c69..8952729 100644
--- a/idp-conf/src/main/resources/system/conf/global-system.xml
+++ b/idp-conf/src/main/resources/system/conf/global-system.xml
@@ -225,8 +225,8 @@
 
     <bean id="shibboleth.DataSealer" lazy-init="true"
         class="net.shibboleth.utilities.java.support.security.DataSealer"
-        p:keyStrategy-ref="shibboleth.DataSealerKeyStrategy"
-        p:lockedAtStartup="#{ !systemProperties.contains('idp.sealer.storePassword') or !systemProperties.contains('idp.sealer.keyPassword') }" />
+        p:keyStrategy-ref="#{ '%{idp.sealer.keyStrategy:shibboleth.DataSealerKeyStrategy}'.trim() }"
+        p:lockedAtStartup="#{!systemProperties.contains('idp.sealer.keyStrategy') and (!systemProperties.contains('idp.sealer.storePassword') or !systemProperties.contains('idp.sealer.keyPassword')) }" />
 
     <!-- This is a convenience for compatibility with the examples for configuring this in V2. -->
     <alias name="shibboleth.DataSealer" alias="shibboleth.TransientIDDataSealer"/>
@@ -248,7 +248,7 @@
         p:cookieManager-ref="shibboleth.PersistentCookieManager"
         p:storageName="%{idp.storage.clientPersistentStorageName:shib_idp_persistent_ss}"
         p:dataSealer-ref="shibboleth.DataSealer"
-        p:keyStrategy-ref="shibboleth.DataSealerKeyStrategy" />
+        p:keyStrategy-ref="#{ '%{idp.sealer.keyStrategy:shibboleth.DataSealerKeyStrategy}'.trim() }" />
 
     <!--
     Default list of ClientStorageService plugins needed for injection into storage read/write flows.

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.