[java-identity-provider] branch master updated: Break apart utilities.xml into separate categories.
Scott Cantor
cantor.2 at osu.edu
Mon Aug 3 19:10:46 UTC 2020
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=a85ab65f6638ed6c053ed9a6aa741fa6ae503b01
The following commit(s) were added to refs/heads/master by this push:
new a85ab65f6 Break apart utilities.xml into separate categories.
a85ab65f6 is described below
commit a85ab65f6638ed6c053ed9a6aa741fa6ae503b01
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Aug 3 15:11:17 2020 -0400
Break apart utilities.xml into separate categories.
---
.../net/shibboleth/idp/conf/conditions.xml | 86 +++++++++
.../idp/conf/{utilities.xml => functions.xml} | 206 +--------------------
.../net/shibboleth/idp/conf/global-system.xml | 103 +----------
.../net/shibboleth/idp/conf/http-client.xml | 84 +++++++++
.../idp/conf/metadata-providers-system.xml | 4 +
.../net/shibboleth/idp/conf/primitives.xml | 57 ++++++
.../net/shibboleth/idp/conf/saml-utilities.xml | 102 ++++++++++
.../net/shibboleth/idp/conf/soap-client.xml | 12 ++
8 files changed, 363 insertions(+), 291 deletions(-)
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/conditions.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/conditions.xml
new file mode 100644
index 000000000..1289b0e21
--- /dev/null
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/conditions.xml
@@ -0,0 +1,86 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:context="http://www.springframework.org/schema/context"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:c="http://www.springframework.org/schema/c"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+
+ default-init-method="initialize"
+ default-destroy-method="destroy">
+
+ <bean id="shibboleth.Conditions.FALSE"
+ class="com.google.common.base.Predicates" factory-method="alwaysFalse" />
+ <bean id="shibboleth.Conditions.TRUE"
+ class="com.google.common.base.Predicates" factory-method="alwaysTrue" />
+
+ <bean id="shibboleth.Conditions.AND"
+ class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="and" abstract="true" />
+ <bean id="shibboleth.Conditions.NOT"
+ class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="not" abstract="true" />
+ <bean id="shibboleth.Conditions.OR"
+ class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="or" abstract="true" />
+
+ <bean id="shibboleth.BiConditions.AND"
+ class="net.shibboleth.utilities.java.support.logic.BiPredicateSupport" factory-method="and" abstract="true" />
+ <bean id="shibboleth.BiConditions.NOT"
+ class="net.shibboleth.utilities.java.support.logic.BiPredicateSupport" factory-method="not" abstract="true" />
+ <bean id="shibboleth.BiConditions.OR"
+ class="net.shibboleth.utilities.java.support.logic.BiPredicateSupport" factory-method="or" abstract="true" />
+
+ <bean id="shibboleth.Conditions.BrowserProfile"
+ class="org.opensaml.profile.logic.BrowserProfilePredicate" />
+ <bean id="shibboleth.Conditions.RelyingPartyId"
+ class="net.shibboleth.idp.profile.logic.RelyingPartyIdPredicate" abstract="true" />
+ <bean id="shibboleth.Conditions.Scripted"
+ class="net.shibboleth.idp.profile.logic.ScriptedPredicate" abstract="true" />
+ <bean id="shibboleth.Conditions.Expression"
+ class="net.shibboleth.idp.profile.logic.SpringExpressionPredicate" abstract="true" />
+
+ <!-- Parent bean for building custom predicates that act on a RP's EntityDescriptor. -->
+ <bean id="shibboleth.Conditions.EntityDescriptor" abstract="true"
+ class="net.shibboleth.utilities.java.support.logic.StrategyIndirectedPredicate"
+ c:objectStrategy-ref="shibboleth.EntityDescriptorLookup.RelyingParty" />
+
+ <!-- Parent bean for building predicates acting over a candidate c14n Subject based on proxy authn. -->
+ <bean id="shibboleth.Conditions.ProxyAuthentication" abstract="true"
+ class="net.shibboleth.utilities.java.support.logic.StrategyIndirectedPredicate">
+ <constructor-arg name="objectStrategy">
+ <bean parent="shibboleth.Functions.Compose">
+ <constructor-arg name="g">
+ <bean class="net.shibboleth.idp.authn.context.navigate.ProxyAuthenticationLookupFunction" />
+ </constructor-arg>
+ <constructor-arg name="f">
+ <bean parent="shibboleth.Functions.Compose">
+ <constructor-arg name="g">
+ <bean class="net.shibboleth.idp.authn.context.navigate.SubjectCanonicalizationContextSubjectLookupFunction" />
+ </constructor-arg>
+ <constructor-arg name="f">
+ <ref bean="shibboleth.ChildLookup.SubjectCanonicalizationContext" />
+ </constructor-arg>
+ </bean>
+ </constructor-arg>
+ </bean>
+ </constructor-arg>
+ </bean>
+
+ <!-- Parent bean for building custom predicates that act on the principal name of the Subject. -->
+ <bean id="shibboleth.Conditions.SubjectName" abstract="true"
+ class="net.shibboleth.utilities.java.support.logic.StrategyIndirectedPredicate">
+ <constructor-arg name="objectStrategy">
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.PrincipalNameLookup.Subject"
+ c:f-ref="shibboleth.ChildLookup.SubjectContext" />
+ </constructor-arg>
+ </bean>
+
+
+ <bean id="shibboleth.Conditions.IssuingDelegatedAssertion"
+ class="net.shibboleth.idp.saml.saml2.profile.delegation.IssuingDelegatedAssertionPredicate" />
+ <bean id="shibboleth.Conditions.AllowedSAMLPresenters" abstract="true"
+ class="net.shibboleth.idp.saml.profile.config.logic.AllowedSAMLPresentersPredicate" />
+
+</beans>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/utilities.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/functions.xml
similarity index 51%
rename from idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/utilities.xml
rename to idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/functions.xml
index 37e4cb25d..05b302e7b 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/utilities.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/functions.xml
@@ -12,52 +12,6 @@
default-init-method="initialize"
default-destroy-method="destroy">
- <bean id="shibboleth.Pair" class="net.shibboleth.utilities.java.support.collection.Pair" abstract="true" />
-
- <bean id="shibboleth.CommaDelimStringArray"
- class="org.springframework.util.StringUtils" factory-method="commaDelimitedListToStringArray" abstract="true" />
-
- <bean id="shibboleth.NonFailFastValidator"
- class="net.shibboleth.idp.attribute.resolver.dc.NonFailFastValidator" lazy-init="true" />
-
- <!-- These are parent beans for custom HTTP clients. -->
-
- <bean id="shibboleth.HttpClientFactory" abstract="true"
- class="net.shibboleth.idp.profile.spring.relyingparty.metadata.HttpClientFactoryBean" />
- <bean id="shibboleth.FileCachingHttpClientFactory" abstract="true"
- class="net.shibboleth.idp.profile.spring.relyingparty.metadata.FileCachingHttpClientFactoryBean" />
- <bean id="shibboleth.MemoryCachingHttpClientFactory" abstract="true"
- class="net.shibboleth.idp.profile.spring.relyingparty.metadata.InMemoryCachingHttpClientFactoryBean" />
-
-
- <bean id="shibboleth.Conditions.FALSE"
- class="com.google.common.base.Predicates" factory-method="alwaysFalse" />
- <bean id="shibboleth.Conditions.TRUE"
- class="com.google.common.base.Predicates" factory-method="alwaysTrue" />
-
- <bean id="shibboleth.Conditions.AND"
- class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="and" abstract="true" />
- <bean id="shibboleth.Conditions.NOT"
- class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="not" abstract="true" />
- <bean id="shibboleth.Conditions.OR"
- class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="or" abstract="true" />
-
- <bean id="shibboleth.BiConditions.AND"
- class="net.shibboleth.utilities.java.support.logic.BiPredicateSupport" factory-method="and" abstract="true" />
- <bean id="shibboleth.BiConditions.NOT"
- class="net.shibboleth.utilities.java.support.logic.BiPredicateSupport" factory-method="not" abstract="true" />
- <bean id="shibboleth.BiConditions.OR"
- class="net.shibboleth.utilities.java.support.logic.BiPredicateSupport" factory-method="or" abstract="true" />
-
- <bean id="shibboleth.Conditions.BrowserProfile"
- class="org.opensaml.profile.logic.BrowserProfilePredicate" />
- <bean id="shibboleth.Conditions.RelyingPartyId"
- class="net.shibboleth.idp.profile.logic.RelyingPartyIdPredicate" abstract="true" />
- <bean id="shibboleth.Conditions.Scripted"
- class="net.shibboleth.idp.profile.logic.ScriptedPredicate" abstract="true" />
- <bean id="shibboleth.Conditions.Expression"
- class="net.shibboleth.idp.profile.logic.SpringExpressionPredicate" abstract="true" />
-
<bean id="shibboleth.Functions.Constant"
class="net.shibboleth.utilities.java.support.logic.FunctionSupport" factory-method="constant" abstract="true" />
<bean id="shibboleth.Functions.Compose"
@@ -72,22 +26,7 @@
class="net.shibboleth.utilities.java.support.logic.ScriptedFunction" abstract="true" />
<bean id="shibboleth.Functions.Expression"
class="net.shibboleth.ext.spring.util.SpringExpressionFunction" abstract="true" />
-
- <!-- Parent bean for indirecting a lookup into a managed/reloadable bean. -->
-
- <bean id="shibboleth.ManagedBean" abstract="true"
- class="net.shibboleth.ext.spring.factory.ProxiedFactoryBean"
- c:service-ref="shibboleth.ManagedBeanService" />
-
- <!-- Parent beans for custom principal types. -->
-
- <bean id="shibboleth.SAML2AuthnContextClassRef"
- class="net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal" abstract="true" />
- <bean id="shibboleth.SAML2AuthnContextDeclRef"
- class="net.shibboleth.idp.saml.authn.principal.AuthnContextDeclRefPrincipal" abstract="true" />
- <bean id="shibboleth.SAML1AuthenticationMethod"
- class="net.shibboleth.idp.saml.authn.principal.AuthenticationMethodPrincipal" abstract="true" />
-
+
<!-- Parent bean for accessing relying party's metadata. -->
<bean id="shibboleth.EntityDescriptorLookup.RelyingParty" parent="shibboleth.Functions.Compose">
<constructor-arg name="g">
@@ -98,49 +37,6 @@
</constructor-arg>
</bean>
- <!-- Parent bean for building custom predicates that act on a RP's EntityDescriptor. -->
- <bean id="shibboleth.Conditions.EntityDescriptor" abstract="true"
- class="net.shibboleth.utilities.java.support.logic.StrategyIndirectedPredicate"
- c:objectStrategy-ref="shibboleth.EntityDescriptorLookup.RelyingParty" />
-
- <!-- Parent bean for building predicates acting over a candidate c14n Subject based on proxy authn. -->
- <bean id="shibboleth.Conditions.ProxyAuthentication" abstract="true"
- class="net.shibboleth.utilities.java.support.logic.StrategyIndirectedPredicate">
- <constructor-arg name="objectStrategy">
- <bean parent="shibboleth.Functions.Compose">
- <constructor-arg name="g">
- <bean class="net.shibboleth.idp.authn.context.navigate.ProxyAuthenticationLookupFunction" />
- </constructor-arg>
- <constructor-arg name="f">
- <bean parent="shibboleth.Functions.Compose">
- <constructor-arg name="g">
- <bean class="net.shibboleth.idp.authn.context.navigate.SubjectCanonicalizationContextSubjectLookupFunction" />
- </constructor-arg>
- <constructor-arg name="f">
- <ref bean="shibboleth.ChildLookup.SubjectCanonicalizationContext" />
- </constructor-arg>
- </bean>
- </constructor-arg>
- </bean>
- </constructor-arg>
- </bean>
-
- <!-- Parent bean for building custom predicates that act on the principal name of the Subject. -->
- <bean id="shibboleth.Conditions.SubjectName" abstract="true"
- class="net.shibboleth.utilities.java.support.logic.StrategyIndirectedPredicate">
- <constructor-arg name="objectStrategy">
- <bean parent="shibboleth.Functions.Compose"
- c:g-ref="shibboleth.PrincipalNameLookup.Subject"
- c:f-ref="shibboleth.ChildLookup.SubjectContext" />
- </constructor-arg>
- </bean>
-
-
- <bean id="shibboleth.Conditions.IssuingDelegatedAssertion"
- class="net.shibboleth.idp.saml.saml2.profile.delegation.IssuingDelegatedAssertionPredicate" />
- <bean id="shibboleth.Conditions.AllowedSAMLPresenters" abstract="true"
- class="net.shibboleth.idp.saml.profile.config.logic.AllowedSAMLPresentersPredicate" />
-
<bean id="shibboleth.ContextFunctions.Scripted"
class="net.shibboleth.idp.profile.context.navigate.ScriptedContextLookupFunction" abstract="true" />
<bean id="shibboleth.ContextFunctions.Expression"
@@ -268,112 +164,26 @@
class="net.shibboleth.idp.authn.context.navigate.SubjectContextPrincipalLookupFunction" />
<bean id="shibboleth.PrincipalNameLookup.Session"
class="net.shibboleth.idp.session.context.navigate.SessionContextPrincipalLookupFunction" />
-
- <bean id="shibboleth.SignatureValidationConfigurationLookup"
+
+ <bean id="shibboleth.SignatureValidationConfigurationLookup" lazy-init="true"
class="net.shibboleth.idp.profile.config.navigate.SignatureValidationConfigurationLookupFunction"
p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
- <bean id="shibboleth.SignatureSigningConfigurationLookup"
+ <bean id="shibboleth.SignatureSigningConfigurationLookup" lazy-init="true"
class="net.shibboleth.idp.profile.config.navigate.SignatureSigningConfigurationLookupFunction"
p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
- <bean id="shibboleth.DecryptionConfigurationLookup"
+ <bean id="shibboleth.DecryptionConfigurationLookup" lazy-init="true"
class="net.shibboleth.idp.profile.config.navigate.DecryptionConfigurationLookupFunction"
p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
- <bean id="shibboleth.EncryptionConfigurationLookup"
+ <bean id="shibboleth.EncryptionConfigurationLookup" lazy-init="true"
class="net.shibboleth.idp.profile.config.navigate.EncryptionConfigurationLookupFunction"
p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
- <bean id="shibboleth.ClientTLSValidationConfigurationLookup"
+ <bean id="shibboleth.ClientTLSValidationConfigurationLookup" lazy-init="true"
class="net.shibboleth.idp.profile.config.navigate.ClientTLSValidationConfigurationLookupFunction"
p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
- <bean id="shibboleth.SelfEncryptionConfigurationLookup"
+ <bean id="shibboleth.SelfEncryptionConfigurationLookup" lazy-init="true"
class="net.shibboleth.idp.profile.config.navigate.SelfEncryptionConfigurationLookupFunction"
p:selfConfiguration="#{getObject('shibboleth.SelfEncryptionConfiguration')}"
p:includeProfileDefaultConfiguration="%{idp.encryption.self.includeProfileDefaultConfiguration:false}"
p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
-
- <bean id="shibboleth.MessageContext.SignatureValidationConfigurationLookup"
- class="net.shibboleth.idp.profile.config.navigate.messaging.SignatureValidationConfigurationLookupFunction"
- p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
- <bean id="shibboleth.MessageContext.SignatureSigningConfigurationLookup"
- class="net.shibboleth.idp.profile.config.navigate.messaging.SignatureSigningConfigurationLookupFunction"
- p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
- <bean id="shibboleth.MessageContext.HttpClientSecurityConfigurationLookup"
- class="net.shibboleth.idp.profile.config.navigate.messaging.HttpClientSecurityConfigurationLookupFunction"
- p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
-
- <util:list id="shibboleth.SAML1Status.VersionMismatch">
- <util:constant static-field="org.opensaml.saml.saml1.core.StatusCode.VERSION_MISMATCH" />
- </util:list>
-
- <util:list id="shibboleth.SAML1Status.Requester">
- <util:constant static-field="org.opensaml.saml.saml1.core.StatusCode.REQUESTER" />
- </util:list>
-
- <util:list id="shibboleth.SAML1Status.RequestDenied">
- <util:constant static-field="org.opensaml.saml.saml1.core.StatusCode.REQUESTER" />
- <util:constant static-field="org.opensaml.saml.saml1.core.StatusCode.REQUEST_DENIED" />
- </util:list>
-
- <util:list id="shibboleth.SAML1Status.Responder">
- <util:constant static-field="org.opensaml.saml.saml1.core.StatusCode.RESPONDER" />
- </util:list>
-
- <util:list id="shibboleth.SAML2Status.VersionMismatch">
- <util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.VERSION_MISMATCH" />
- </util:list>
-
- <util:list id="shibboleth.SAML2Status.RequestDenied">
- <util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.REQUESTER" />
- <util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.REQUEST_DENIED" />
- </util:list>
-
- <util:list id="shibboleth.SAML2Status.RequestUnsupported">
- <util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.REQUESTER" />
- <util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.REQUEST_UNSUPPORTED" />
- </util:list>
-
- <util:list id="shibboleth.SAML2Status.UnsupportedBinding">
- <util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.REQUESTER" />
- <util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.UNSUPPORTED_BINDING" />
- </util:list>
-
- <util:list id="shibboleth.SAML2Status.NoAuthnContext">
- <util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.REQUESTER" />
- <util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.NO_AUTHN_CONTEXT" />
- </util:list>
-
- <util:list id="shibboleth.SAML2Status.AuthnFailed">
- <util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.REQUESTER" />
- <util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.AUTHN_FAILED" />
- </util:list>
-
- <util:list id="shibboleth.SAML2Status.NoPassive">
- <util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.REQUESTER" />
- <util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.NO_PASSIVE" />
- </util:list>
-
- <util:list id="shibboleth.SAML2Status.UnknownPrincipal">
- <util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.REQUESTER" />
- <util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.UNKNOWN_PRINCIPAL" />
- </util:list>
-
- <util:list id="shibboleth.SAML2Status.InvalidNameIDPolicy">
- <util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.REQUESTER" />
- <util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.INVALID_NAMEID_POLICY" />
- </util:list>
-
- <util:list id="shibboleth.SAML2Status.ProxyCountExceeded">
- <util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.RESPONDER" />
- <util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.PROXY_COUNT_EXCEEDED" />
- </util:list>
-
- <util:list id="shibboleth.SAML2Status.ChannelBindingsError">
- <util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.REQUESTER" />
- <util:constant static-field="org.opensaml.saml.common.xml.SAMLConstants.SAML20CB_NS" />
- </util:list>
-
- <util:constant id="shibboleth.SOAP.Client" static-field="org.opensaml.soap.soap11.FaultCode.CLIENT"/>
- <util:constant id="shibboleth.SOAP.Server" static-field="org.opensaml.soap.soap11.FaultCode.SERVER"/>
- <util:constant id="shibboleth.SOAP.MustUnderstand" static-field="org.opensaml.soap.soap11.FaultCode.MUST_UNDERSTAND"/>
- <util:constant id="shibboleth.SOAP.VersionMismatch" static-field="org.opensaml.soap.soap11.FaultCode.VERSION_MISMATCH"/>
</beans>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/global-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/global-system.xml
index d161b7d83..e12d4f919 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/global-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/global-system.xml
@@ -61,8 +61,12 @@
<import resource="profile-intercept-system.xml" />
<import resource="cas-protocol-system.xml" />
<import resource="general-admin-system.xml" />
- <import resource="utilities.xml" />
+ <import resource="primitives.xml" />
+ <import resource="conditions.xml" />
+ <import resource="functions.xml" />
+ <import resource="http-client.xml" />
<import resource="soap-client.xml" />
+ <import resource="saml-utilities.xml" />
<bean id="systemPrereqs" class="org.springframework.beans.factory.config.MethodInvokingBean"
p:targetObject-ref="systemProperties" p:targetMethod="putAll">
@@ -285,6 +289,9 @@
</property>
</bean>
+ <bean id="shibboleth.NonFailFastValidator"
+ class="net.shibboleth.idp.attribute.resolver.dc.NonFailFastValidator" lazy-init="true" />
+
<!-- Parent beans for Signature/Encryption/TLS/HttpClientSecurity Configuration objects. -->
<bean class="net.shibboleth.ext.spring.util.DeprecatedBeanDetector" c:_1="global.xml">
@@ -354,47 +361,7 @@
<bean id="shibboleth.KeyInfoCredentialResolver"
class="org.opensaml.xmlsec.config.impl.DefaultSecurityConfigurationBootstrap"
factory-method="buildBasicInlineKeyInfoCredentialResolver" />
-
- <!-- These are deprecated because using them triggers Spring bugs when contexts reload. -->
-
- <bean id="shibboleth.NonCachingHttpClient"
- lazy-init="true"
- class="net.shibboleth.idp.profile.spring.relyingparty.metadata.impl.HttpClientFactoryBean"
- p:tLSSocketFactory="#{ %{idp.httpclient.useTrustEngineTLSSocketFactory:false} or %{idp.httpclient.useSecurityEnhancedTLSSocketFactory:false} ? @'shibboleth.SecurityEnhancedTLSSocketFactory' : null }"
- p:connectionDisregardTLSCertificate="%{idp.httpclient.connectionDisregardTLSCertificate:false}"
- p:connectionTimeout="%{idp.httpclient.connectionTimeout:PT1M}"
- p:connectionRequestTimeout="%{idp.httpclient.connectionRequestTimeout:PT1M}"
- p:socketTimeout="%{idp.httpclient.socketTimeout:PT1M}"
- p:maxConnectionsTotal="%{idp.httpclient.maxConnectionsTotal:100}"
- p:maxConnectionsPerRoute="%{idp.httpclient.maxConnectionsPerRoute:100}" />
-
- <bean id="shibboleth.FileCachingHttpClient"
- lazy-init="true"
- class="net.shibboleth.idp.profile.spring.relyingparty.metadata.impl.FileCachingHttpClientFactoryBean"
- p:tLSSocketFactory="#{ %{idp.httpclient.useTrustEngineTLSSocketFactory:false} or %{idp.httpclient.useSecurityEnhancedTLSSocketFactory:false} ? @'shibboleth.SecurityEnhancedTLSSocketFactory' : null }"
- p:connectionDisregardTLSCertificate="%{idp.httpclient.connectionDisregardTLSCertificate:false}"
- p:connectionTimeout="%{idp.httpclient.connectionTimeout:PT1M}"
- p:connectionRequestTimeout="%{idp.httpclient.connectionRequestTimeout:PT1M}"
- p:socketTimeout="%{idp.httpclient.socketTimeout:PT1M}"
- p:maxConnectionsTotal="%{idp.httpclient.maxConnectionsTotal:100}"
- p:maxConnectionsPerRoute="%{idp.httpclient.maxConnectionsPerRoute:100}"
- p:cacheDirectory="%{idp.httpclient.filecaching.cacheDirectory}"
- p:maxCacheEntries="%{idp.httpclient.filecaching.maxCacheEntries:100}"
- p:maxCacheEntrySize="%{idp.httpclient.filecaching.maxCacheEntrySize:10485760}" />
-
- <bean id="shibboleth.MemoryCachingHttpClient"
- lazy-init="true"
- class="net.shibboleth.idp.profile.spring.relyingparty.metadata.impl.InMemoryCachingHttpClientFactoryBean"
- p:tLSSocketFactory="#{ %{idp.httpclient.useTrustEngineTLSSocketFactory:false} or %{idp.httpclient.useSecurityEnhancedTLSSocketFactory:false} ? @'shibboleth.SecurityEnhancedTLSSocketFactory' : null }"
- p:connectionDisregardTLSCertificate="%{idp.httpclient.connectionDisregardTLSCertificate:false}"
- p:connectionTimeout="%{idp.httpclient.connectionTimeout:PT1M}"
- p:connectionRequestTimeout="%{idp.httpclient.connectionRequestTimeout:PT1M}"
- p:socketTimeout="%{idp.httpclient.socketTimeout:PT1M}"
- p:maxConnectionsTotal="%{idp.httpclient.maxConnectionsTotal:100}"
- p:maxConnectionsPerRoute="%{idp.httpclient.maxConnectionsPerRoute:100}"
- p:maxCacheEntries="%{idp.httpclient.memorycaching.maxCacheEntries:50}"
- p:maxCacheEntrySize="%{idp.httpclient.memorycaching.maxCacheEntrySize:1048576}" />
-
+
<!-- Back to non-deprecated beans. -->
<!--
@@ -410,34 +377,7 @@
p:socketTimeout="%{idp.httpclient.socketTimeout:PT1M}"
p:maxConnectionsTotal="%{idp.httpclient.maxConnectionsTotal:100}"
p:maxConnectionsPerRoute="%{idp.httpclient.maxConnectionsPerRoute:100}" />
-
- <bean id="shibboleth.SecurityEnhancedTLSSocketFactory" name="shibboleth.TrustEngineTLSSocketFactory"
- lazy-init="true"
- class="org.opensaml.security.httpclient.impl.SecurityEnhancedHttpClientSupport"
- factory-method="buildTLSSocketFactory" />
-
- <bean id="shibboleth.SecurityEnhancedTLSSocketFactoryWithClientTLS"
- lazy-init="true"
- class="org.opensaml.security.httpclient.impl.SecurityEnhancedHttpClientSupport"
- factory-method="buildTLSSocketFactoryWithClientTLS" />
-
- <bean id="shibboleth.SecurityEnhancedTLSSocketFactoryWithClientTLSOnly"
- lazy-init="true"
- class="org.opensaml.security.httpclient.impl.SecurityEnhancedHttpClientSupport"
- factory-method="buildTLSSocketFactoryWithClientTLSOnly" />
-
- <bean id="shibboleth.StaticExplicitTrustEngine" abstract="true"
- class="net.shibboleth.idp.profile.spring.factory.StaticExplicitKeyFactoryBean" />
-
- <bean id="shibboleth.StaticPKIXTrustEngine" abstract="true"
- class="net.shibboleth.idp.profile.spring.factory.StaticPKIXFactoryBean" />
-
- <bean id="shibboleth.HTTPResource" abstract="true"
- class="net.shibboleth.idp.profile.spring.resource.impl.HTTPResourceFactoryBean" />
-
- <bean id="shibboleth.X509TrustManager" abstract="true"
- class="org.opensaml.security.trust.impl.TrustEngineX509TrustManager" />
-
+
<!-- Default Jackson ObjectMapper. -->
<bean id="shibboleth.JSONObjectMapper" class="com.fasterxml.jackson.databind.ObjectMapper" />
@@ -498,27 +438,4 @@
</property>
</bean>
- <!-- Beans for user-visible metadata configuration usage -->
-
- <!-- Secondary indexing support -->
-
- <bean id="shibboleth.Metadata.Index.SAMLArtifact" class="org.opensaml.saml.metadata.resolver.index.impl.SAMLArtifactMetadataIndex" />
-
- <!-- Note: By default this indexes all endpoints under all roles.
- To index more selectively by role and endpoint name/type, use the predicate below. -->
- <bean id="shibboleth.Metadata.Index.Endpoint" class="org.opensaml.saml.metadata.resolver.index.impl.EndpointMetadataIndex" />
-
- <!-- By default this predicate selects no endpoints to index.
- So this would typically be used only as a parent bean, with an added ctor param.
- This would be a Map<QName, Set<QName>> (RoleDescriptor element/type -> Endpoint(s) element/type),
- either as a single ctor param or as a named ctor param c:indexableTypes. -->
- <bean id="shibboleth.Metadata.Index.Endpoint.Predicate.ByRoleAndEndpoint"
- class="org.opensaml.saml.metadata.resolver.index.impl.EndpointMetadataIndex.DefaultEndpointSelectionPredicate" />
-
-
- <!-- Metadata Query Protocol (MDQ) support -->
-
- <bean id="shibboleth.Metadata.MDQ.URLBuilder.SAMLArtifact" class="org.opensaml.saml.metadata.resolver.impl.SAMLArtifactURLBuilder" />
-
-
</beans>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/http-client.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/http-client.xml
new file mode 100644
index 000000000..06a030279
--- /dev/null
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/http-client.xml
@@ -0,0 +1,84 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:context="http://www.springframework.org/schema/context"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:c="http://www.springframework.org/schema/c"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+
+ default-init-method="initialize"
+ default-destroy-method="destroy">
+
+ <!-- These are parent beans for custom HTTP clients and resources. -->
+
+ <bean id="shibboleth.HttpClientFactory" abstract="true"
+ class="net.shibboleth.idp.profile.spring.relyingparty.metadata.HttpClientFactoryBean" />
+ <bean id="shibboleth.FileCachingHttpClientFactory" abstract="true"
+ class="net.shibboleth.idp.profile.spring.relyingparty.metadata.FileCachingHttpClientFactoryBean" />
+ <bean id="shibboleth.MemoryCachingHttpClientFactory" abstract="true"
+ class="net.shibboleth.idp.profile.spring.relyingparty.metadata.InMemoryCachingHttpClientFactoryBean" />
+
+ <bean id="shibboleth.HTTPResource" abstract="true"
+ class="net.shibboleth.idp.profile.spring.resource.impl.HTTPResourceFactoryBean" />
+
+ <!-- Socket Factory implementations -->
+
+ <bean id="shibboleth.SecurityEnhancedTLSSocketFactory" name="shibboleth.TrustEngineTLSSocketFactory"
+ lazy-init="true"
+ class="org.opensaml.security.httpclient.impl.SecurityEnhancedHttpClientSupport"
+ factory-method="buildTLSSocketFactory" />
+
+ <bean id="shibboleth.SecurityEnhancedTLSSocketFactoryWithClientTLS"
+ lazy-init="true"
+ class="org.opensaml.security.httpclient.impl.SecurityEnhancedHttpClientSupport"
+ factory-method="buildTLSSocketFactoryWithClientTLS" />
+
+ <bean id="shibboleth.SecurityEnhancedTLSSocketFactoryWithClientTLSOnly"
+ lazy-init="true"
+ class="org.opensaml.security.httpclient.impl.SecurityEnhancedHttpClientSupport"
+ factory-method="buildTLSSocketFactoryWithClientTLSOnly" />
+
+ <!-- These are deprecated because using them triggers Spring bugs when contexts reload. -->
+
+ <bean id="shibboleth.NonCachingHttpClient"
+ lazy-init="true"
+ class="net.shibboleth.idp.profile.spring.relyingparty.metadata.impl.HttpClientFactoryBean"
+ p:tLSSocketFactory="#{ %{idp.httpclient.useTrustEngineTLSSocketFactory:false} or %{idp.httpclient.useSecurityEnhancedTLSSocketFactory:false} ? @'shibboleth.SecurityEnhancedTLSSocketFactory' : null }"
+ p:connectionDisregardTLSCertificate="%{idp.httpclient.connectionDisregardTLSCertificate:false}"
+ p:connectionTimeout="%{idp.httpclient.connectionTimeout:PT1M}"
+ p:connectionRequestTimeout="%{idp.httpclient.connectionRequestTimeout:PT1M}"
+ p:socketTimeout="%{idp.httpclient.socketTimeout:PT1M}"
+ p:maxConnectionsTotal="%{idp.httpclient.maxConnectionsTotal:100}"
+ p:maxConnectionsPerRoute="%{idp.httpclient.maxConnectionsPerRoute:100}" />
+
+ <bean id="shibboleth.FileCachingHttpClient"
+ lazy-init="true"
+ class="net.shibboleth.idp.profile.spring.relyingparty.metadata.impl.FileCachingHttpClientFactoryBean"
+ p:tLSSocketFactory="#{ %{idp.httpclient.useTrustEngineTLSSocketFactory:false} or %{idp.httpclient.useSecurityEnhancedTLSSocketFactory:false} ? @'shibboleth.SecurityEnhancedTLSSocketFactory' : null }"
+ p:connectionDisregardTLSCertificate="%{idp.httpclient.connectionDisregardTLSCertificate:false}"
+ p:connectionTimeout="%{idp.httpclient.connectionTimeout:PT1M}"
+ p:connectionRequestTimeout="%{idp.httpclient.connectionRequestTimeout:PT1M}"
+ p:socketTimeout="%{idp.httpclient.socketTimeout:PT1M}"
+ p:maxConnectionsTotal="%{idp.httpclient.maxConnectionsTotal:100}"
+ p:maxConnectionsPerRoute="%{idp.httpclient.maxConnectionsPerRoute:100}"
+ p:cacheDirectory="%{idp.httpclient.filecaching.cacheDirectory}"
+ p:maxCacheEntries="%{idp.httpclient.filecaching.maxCacheEntries:100}"
+ p:maxCacheEntrySize="%{idp.httpclient.filecaching.maxCacheEntrySize:10485760}" />
+
+ <bean id="shibboleth.MemoryCachingHttpClient"
+ lazy-init="true"
+ class="net.shibboleth.idp.profile.spring.relyingparty.metadata.impl.InMemoryCachingHttpClientFactoryBean"
+ p:tLSSocketFactory="#{ %{idp.httpclient.useTrustEngineTLSSocketFactory:false} or %{idp.httpclient.useSecurityEnhancedTLSSocketFactory:false} ? @'shibboleth.SecurityEnhancedTLSSocketFactory' : null }"
+ p:connectionDisregardTLSCertificate="%{idp.httpclient.connectionDisregardTLSCertificate:false}"
+ p:connectionTimeout="%{idp.httpclient.connectionTimeout:PT1M}"
+ p:connectionRequestTimeout="%{idp.httpclient.connectionRequestTimeout:PT1M}"
+ p:socketTimeout="%{idp.httpclient.socketTimeout:PT1M}"
+ p:maxConnectionsTotal="%{idp.httpclient.maxConnectionsTotal:100}"
+ p:maxConnectionsPerRoute="%{idp.httpclient.maxConnectionsPerRoute:100}"
+ p:maxCacheEntries="%{idp.httpclient.memorycaching.maxCacheEntries:50}"
+ p:maxCacheEntrySize="%{idp.httpclient.memorycaching.maxCacheEntrySize:1048576}" />
+
+</beans>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/metadata-providers-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/metadata-providers-system.xml
index 11ad44185..39ae36169 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/metadata-providers-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/metadata-providers-system.xml
@@ -45,4 +45,8 @@
</property>
</bean>
+ <!-- Metadata Query Protocol (MDQ) artifact support. -->
+ <bean id="shibboleth.Metadata.MDQ.URLBuilder.SAMLArtifact" lazy-init="true"
+ class="org.opensaml.saml.metadata.resolver.impl.SAMLArtifactURLBuilder" />
+
</beans>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/primitives.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/primitives.xml
new file mode 100644
index 000000000..97c60ee4e
--- /dev/null
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/primitives.xml
@@ -0,0 +1,57 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:context="http://www.springframework.org/schema/context"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:c="http://www.springframework.org/schema/c"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+
+ default-init-method="initialize"
+ default-destroy-method="destroy">
+
+ <!-- Low-level helpers. -->
+
+ <bean id="shibboleth.Pair" class="net.shibboleth.utilities.java.support.collection.Pair" abstract="true" />
+
+ <bean id="shibboleth.CommaDelimStringArray"
+ class="org.springframework.util.StringUtils" factory-method="commaDelimitedListToStringArray" abstract="true" />
+
+ <!-- Parent bean for indirecting a lookup into a managed/reloadable bean. -->
+
+ <bean id="shibboleth.ManagedBean" abstract="true"
+ class="net.shibboleth.ext.spring.factory.ProxiedFactoryBean"
+ c:service-ref="shibboleth.ManagedBeanService" />
+
+ <!-- TrustEngine helpers. -->
+
+ <bean id="shibboleth.StaticExplicitTrustEngine" abstract="true"
+ class="net.shibboleth.idp.profile.spring.factory.StaticExplicitKeyFactoryBean" />
+
+ <bean id="shibboleth.StaticPKIXTrustEngine" abstract="true"
+ class="net.shibboleth.idp.profile.spring.factory.StaticPKIXFactoryBean" />
+
+ <bean id="shibboleth.X509TrustManager" abstract="true"
+ class="org.opensaml.security.trust.impl.TrustEngineX509TrustManager" />
+
+ <!-- Beans for user-visible metadata configuration usage. -->
+
+ <!-- Secondary indexing support -->
+ <bean id="shibboleth.Metadata.Index.SAMLArtifact" lazy-init="true"
+ class="org.opensaml.saml.metadata.resolver.index.impl.SAMLArtifactMetadataIndex" />
+
+ <!-- Note: By default this indexes all endpoints under all roles.
+ To index more selectively by role and endpoint name/type, use the predicate below. -->
+ <bean id="shibboleth.Metadata.Index.Endpoint" lazy-init="true"
+ class="org.opensaml.saml.metadata.resolver.index.impl.EndpointMetadataIndex" />
+
+ <!-- By default this predicate selects no endpoints to index.
+ So this would typically be used only as a parent bean, with an added ctor param.
+ This would be a Map<QName, Set<QName>> (RoleDescriptor element/type -> Endpoint(s) element/type),
+ either as a single ctor param or as a named ctor param c:indexableTypes. -->
+ <bean id="shibboleth.Metadata.Index.Endpoint.Predicate.ByRoleAndEndpoint" lazy-init="true"
+ class="org.opensaml.saml.metadata.resolver.index.impl.EndpointMetadataIndex.DefaultEndpointSelectionPredicate" />
+
+</beans>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/saml-utilities.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/saml-utilities.xml
new file mode 100644
index 000000000..d5bc452ee
--- /dev/null
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/saml-utilities.xml
@@ -0,0 +1,102 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:context="http://www.springframework.org/schema/context"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:c="http://www.springframework.org/schema/c"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+
+ default-init-method="initialize"
+ default-destroy-method="destroy">
+
+ <!-- Parent beans for custom principal types. -->
+
+ <bean id="shibboleth.SAML2AuthnContextClassRef"
+ class="net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal" abstract="true" />
+ <bean id="shibboleth.SAML2AuthnContextDeclRef"
+ class="net.shibboleth.idp.saml.authn.principal.AuthnContextDeclRefPrincipal" abstract="true" />
+ <bean id="shibboleth.SAML1AuthenticationMethod"
+ class="net.shibboleth.idp.saml.authn.principal.AuthenticationMethodPrincipal" abstract="true" />
+
+ <!-- Status code shortcut beans. -->
+
+ <util:list id="shibboleth.SAML1Status.VersionMismatch">
+ <util:constant static-field="org.opensaml.saml.saml1.core.StatusCode.VERSION_MISMATCH" />
+ </util:list>
+
+ <util:list id="shibboleth.SAML1Status.Requester">
+ <util:constant static-field="org.opensaml.saml.saml1.core.StatusCode.REQUESTER" />
+ </util:list>
+
+ <util:list id="shibboleth.SAML1Status.RequestDenied">
+ <util:constant static-field="org.opensaml.saml.saml1.core.StatusCode.REQUESTER" />
+ <util:constant static-field="org.opensaml.saml.saml1.core.StatusCode.REQUEST_DENIED" />
+ </util:list>
+
+ <util:list id="shibboleth.SAML1Status.Responder">
+ <util:constant static-field="org.opensaml.saml.saml1.core.StatusCode.RESPONDER" />
+ </util:list>
+
+ <util:list id="shibboleth.SAML2Status.VersionMismatch">
+ <util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.VERSION_MISMATCH" />
+ </util:list>
+
+ <util:list id="shibboleth.SAML2Status.RequestDenied">
+ <util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.REQUESTER" />
+ <util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.REQUEST_DENIED" />
+ </util:list>
+
+ <util:list id="shibboleth.SAML2Status.RequestUnsupported">
+ <util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.REQUESTER" />
+ <util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.REQUEST_UNSUPPORTED" />
+ </util:list>
+
+ <util:list id="shibboleth.SAML2Status.UnsupportedBinding">
+ <util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.REQUESTER" />
+ <util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.UNSUPPORTED_BINDING" />
+ </util:list>
+
+ <util:list id="shibboleth.SAML2Status.NoAuthnContext">
+ <util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.REQUESTER" />
+ <util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.NO_AUTHN_CONTEXT" />
+ </util:list>
+
+ <util:list id="shibboleth.SAML2Status.AuthnFailed">
+ <util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.REQUESTER" />
+ <util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.AUTHN_FAILED" />
+ </util:list>
+
+ <util:list id="shibboleth.SAML2Status.NoPassive">
+ <util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.REQUESTER" />
+ <util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.NO_PASSIVE" />
+ </util:list>
+
+ <util:list id="shibboleth.SAML2Status.UnknownPrincipal">
+ <util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.REQUESTER" />
+ <util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.UNKNOWN_PRINCIPAL" />
+ </util:list>
+
+ <util:list id="shibboleth.SAML2Status.InvalidNameIDPolicy">
+ <util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.REQUESTER" />
+ <util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.INVALID_NAMEID_POLICY" />
+ </util:list>
+
+ <util:list id="shibboleth.SAML2Status.ProxyCountExceeded">
+ <util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.RESPONDER" />
+ <util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.PROXY_COUNT_EXCEEDED" />
+ </util:list>
+
+ <util:list id="shibboleth.SAML2Status.ChannelBindingsError">
+ <util:constant static-field="org.opensaml.saml.saml2.core.StatusCode.REQUESTER" />
+ <util:constant static-field="org.opensaml.saml.common.xml.SAMLConstants.SAML20CB_NS" />
+ </util:list>
+
+ <util:constant id="shibboleth.SOAP.Client" static-field="org.opensaml.soap.soap11.FaultCode.CLIENT"/>
+ <util:constant id="shibboleth.SOAP.Server" static-field="org.opensaml.soap.soap11.FaultCode.SERVER"/>
+ <util:constant id="shibboleth.SOAP.MustUnderstand" static-field="org.opensaml.soap.soap11.FaultCode.MUST_UNDERSTAND"/>
+ <util:constant id="shibboleth.SOAP.VersionMismatch" static-field="org.opensaml.soap.soap11.FaultCode.VERSION_MISMATCH"/>
+
+</beans>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/soap-client.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/soap-client.xml
index 718d8e513..d396cb0fd 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/soap-client.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/soap-client.xml
@@ -17,6 +17,18 @@
<alias alias="SOAPClient.SAML.HttpClient" name="SOAPClient.HttpClient" />
+ <!-- Security Configuration lookup -->
+
+ <bean id="shibboleth.MessageContext.SignatureValidationConfigurationLookup"
+ class="net.shibboleth.idp.profile.config.navigate.messaging.SignatureValidationConfigurationLookupFunction"
+ p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
+ <bean id="shibboleth.MessageContext.SignatureSigningConfigurationLookup"
+ class="net.shibboleth.idp.profile.config.navigate.messaging.SignatureSigningConfigurationLookupFunction"
+ p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
+ <bean id="shibboleth.MessageContext.HttpClientSecurityConfigurationLookup"
+ class="net.shibboleth.idp.profile.config.navigate.messaging.HttpClientSecurityConfigurationLookupFunction"
+ p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
+
<!-- SOAP client and pipeline factory definitions. -->
<bean id="SOAPClient.SAML.LocatorMap" class="org.opensaml.soap.client.http.PipelineFactoryHttpSOAPClient">
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list