[java-identity-provider] branch master updated: Move security beans into separate file.
Scott Cantor
cantor.2 at osu.edu
Mon Aug 3 19:28:20 UTC 2020
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=900dd2dfb6261e73becd70bde88dc00bd6c835ea
The following commit(s) were added to refs/heads/master by this push:
new 900dd2dfb Move security beans into separate file.
900dd2dfb is described below
commit 900dd2dfb6261e73becd70bde88dc00bd6c835ea
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Aug 3 15:29:28 2020 -0400
Move security beans into separate file.
---
.../net/shibboleth/idp/conf/functions.xml | 23 +----
.../net/shibboleth/idp/conf/global-system.xml | 67 +-------------
.../net/shibboleth/idp/conf/security-system.xml | 100 +++++++++++++++++++++
3 files changed, 103 insertions(+), 87 deletions(-)
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/functions.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/functions.xml
index 05b302e7b..7a2a473ee 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/functions.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/functions.xml
@@ -164,26 +164,5 @@
class="net.shibboleth.idp.authn.context.navigate.SubjectContextPrincipalLookupFunction" />
<bean id="shibboleth.PrincipalNameLookup.Session"
class="net.shibboleth.idp.session.context.navigate.SessionContextPrincipalLookupFunction" />
-
- <bean id="shibboleth.SignatureValidationConfigurationLookup" lazy-init="true"
- class="net.shibboleth.idp.profile.config.navigate.SignatureValidationConfigurationLookupFunction"
- p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
- <bean id="shibboleth.SignatureSigningConfigurationLookup" lazy-init="true"
- class="net.shibboleth.idp.profile.config.navigate.SignatureSigningConfigurationLookupFunction"
- p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
- <bean id="shibboleth.DecryptionConfigurationLookup" lazy-init="true"
- class="net.shibboleth.idp.profile.config.navigate.DecryptionConfigurationLookupFunction"
- p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
- <bean id="shibboleth.EncryptionConfigurationLookup" lazy-init="true"
- class="net.shibboleth.idp.profile.config.navigate.EncryptionConfigurationLookupFunction"
- p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
- <bean id="shibboleth.ClientTLSValidationConfigurationLookup" lazy-init="true"
- class="net.shibboleth.idp.profile.config.navigate.ClientTLSValidationConfigurationLookupFunction"
- p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
- <bean id="shibboleth.SelfEncryptionConfigurationLookup" lazy-init="true"
- class="net.shibboleth.idp.profile.config.navigate.SelfEncryptionConfigurationLookupFunction"
- p:selfConfiguration="#{getObject('shibboleth.SelfEncryptionConfiguration')}"
- p:includeProfileDefaultConfiguration="%{idp.encryption.self.includeProfileDefaultConfiguration:false}"
- p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
-
+
</beans>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/global-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/global-system.xml
index e12d4f919..c4311b51c 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/global-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/global-system.xml
@@ -55,6 +55,7 @@
<import resource="audit-system.xml" />
<import resource="general-authn-system.xml" />
<import resource="session-manager-system.xml" />
+ <import resource="security-system.xml" />
<import resource="services-system.xml" />
<import resource="saml-binding-config.xml" />
<import resource="subject-c14n-system.xml" />
@@ -277,9 +278,6 @@
class="org.opensaml.saml.common.binding.artifact.impl.StorageServiceSAMLArtifactMap"
p:storageService-ref="#{'%{idp.artifact.StorageService:shibboleth.StorageService}'.trim()}" />
- <bean id="shibboleth.DefaultIdentifierGenerationStrategy"
- class="net.shibboleth.utilities.java.support.security.impl.SecureRandomIdentifierGenerationStrategy" />
-
<bean id="shibboleth.StorageBackedAccountLockoutManager" abstract="true"
class="net.shibboleth.idp.authn.impl.StorageBackedAccountLockoutManager"
p:storageService-ref="shibboleth.StorageService">
@@ -292,8 +290,6 @@
<bean id="shibboleth.NonFailFastValidator"
class="net.shibboleth.idp.attribute.resolver.dc.NonFailFastValidator" lazy-init="true" />
- <!-- Parent beans for Signature/Encryption/TLS/HttpClientSecurity Configuration objects. -->
-
<bean class="net.shibboleth.ext.spring.util.DeprecatedBeanDetector" c:_1="global.xml">
<constructor-arg index="0">
<map>
@@ -304,66 +300,7 @@
</map>
</constructor-arg>
</bean>
-
- <bean id="shibboleth.BasicSignatureValidationConfiguration" abstract="true"
- class="org.opensaml.xmlsec.impl.BasicSignatureValidationConfiguration"
- p:includedAlgorithms="#{getObject('shibboleth.IncludedSignatureAlgorithms') ?: getObject('shibboleth.SignatureWhitelist')}"
- p:excludedAlgorithms="#{getObject('shibboleth.ExcludedSignatureAlgorithms') ?: getObject('shibboleth.SignatureBlacklist')}" />
-
- <bean id="shibboleth.BasicClientTLSValidationConfiguration" abstract="true"
- class="org.opensaml.security.x509.tls.impl.BasicClientTLSValidationConfiguration" />
-
- <bean id="shibboleth.BasicHttpClientSecurityConfiguration" abstract="true"
- class="org.opensaml.security.httpclient.impl.BasicHttpClientSecurityConfiguration" />
-
- <bean id="shibboleth.BasicSignatureSigningConfiguration" abstract="true"
- class="org.opensaml.xmlsec.impl.BasicSignatureSigningConfiguration"
- p:includedAlgorithms="#{getObject('shibboleth.IncludedSignatureAlgorithms') ?: getObject('shibboleth.SignatureWhitelist')}"
- p:excludedAlgorithms="#{getObject('shibboleth.ExcludedSignatureAlgorithms') ?: getObject('shibboleth.SignatureBlacklist')}" />
-
- <bean id="shibboleth.BasicEncryptionConfiguration" abstract="true"
- class="org.opensaml.xmlsec.impl.BasicEncryptionConfiguration"
- p:includedAlgorithms="#{getObject('shibboleth.IncludedEncryptionAlgorithms') ?: getObject('shibboleth.EncryptionWhitelist')}"
- p:excludedAlgorithms="#{getObject('shibboleth.ExcludedEncryptionAlgorithms') ?: getObject('shibboleth.EncryptionBlacklist')}" />
-
- <bean id="shibboleth.BasicDecryptionConfiguration" abstract="true"
- class="org.opensaml.xmlsec.impl.BasicDecryptionConfiguration"
- p:includedAlgorithms="#{getObject('shibboleth.IncludedEncryptionAlgorithms') ?: getObject('shibboleth.EncryptionWhitelist')}"
- p:excludedAlgorithms="#{getObject('shibboleth.ExcludedEncryptionAlgorithms') ?: getObject('shibboleth.EncryptionBlacklist')}" />
-
- <!-- Beans that implement the mashing of security configurations into final parameter sets. -->
-
- <bean id="shibboleth.SignatureValidationParametersResolver"
- class="org.opensaml.xmlsec.impl.BasicSignatureValidationParametersResolver" />
- <bean id="shibboleth.SignatureSigningParametersResolver"
- class="org.opensaml.saml.security.impl.SAMLMetadataSignatureSigningParametersResolver" />
- <bean id="shibboleth.DecryptionParametersResolver"
- class="org.opensaml.xmlsec.impl.BasicDecryptionParametersResolver" />
- <bean id="shibboleth.EncryptionParametersResolver"
- class="org.opensaml.saml.security.impl.SAMLMetadataEncryptionParametersResolver"
- c:resolver-ref="shibboleth.MetadataCredentialResolver" />
- <bean id="shibboleth.ClientTLSValidationParametersResolver"
- class="org.opensaml.security.x509.tls.impl.BasicClientTLSValidationParametersResolver" />
- <bean id="shibboleth.HttpClientSecurityParametersResolver"
- class="org.opensaml.security.httpclient.impl.BasicHttpClientSecurityParametersResolver" />
-
- <!--
- The beans below are primarily used by trust engines in relying-party-system.xml, but also in the
- resolver for encryption parameters above.
- -->
-
- <bean id="shibboleth.MetadataCredentialResolver"
- class="org.opensaml.saml.security.impl.MetadataCredentialResolver"
- p:roleDescriptorResolver-ref="shibboleth.RoleDescriptorResolver"
- p:keyInfoCredentialResolver-ref="shibboleth.KeyInfoCredentialResolver">
- </bean>
-
- <bean id="shibboleth.KeyInfoCredentialResolver"
- class="org.opensaml.xmlsec.config.impl.DefaultSecurityConfigurationBootstrap"
- factory-method="buildBasicInlineKeyInfoCredentialResolver" />
-
- <!-- Back to non-deprecated beans. -->
-
+
<!--
This is a default client for embedded system use but should NOT be used by deployers OR
within the IdP within any reloadable service child contexts.
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/security-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/security-system.xml
new file mode 100644
index 000000000..a43cff844
--- /dev/null
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/security-system.xml
@@ -0,0 +1,100 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:context="http://www.springframework.org/schema/context"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:c="http://www.springframework.org/schema/c"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+
+ default-init-method="initialize"
+ default-destroy-method="destroy">
+
+ <bean id="shibboleth.DefaultIdentifierGenerationStrategy"
+ class="net.shibboleth.utilities.java.support.security.impl.SecureRandomIdentifierGenerationStrategy" />
+
+ <!-- Principally used in relying-party.xml to define new security configurations. -->
+
+ <bean id="shibboleth.BasicSignatureValidationConfiguration" abstract="true"
+ class="org.opensaml.xmlsec.impl.BasicSignatureValidationConfiguration"
+ p:includedAlgorithms="#{getObject('shibboleth.IncludedSignatureAlgorithms') ?: getObject('shibboleth.SignatureWhitelist')}"
+ p:excludedAlgorithms="#{getObject('shibboleth.ExcludedSignatureAlgorithms') ?: getObject('shibboleth.SignatureBlacklist')}" />
+
+ <bean id="shibboleth.BasicClientTLSValidationConfiguration" abstract="true"
+ class="org.opensaml.security.x509.tls.impl.BasicClientTLSValidationConfiguration" />
+
+ <bean id="shibboleth.BasicHttpClientSecurityConfiguration" abstract="true"
+ class="org.opensaml.security.httpclient.impl.BasicHttpClientSecurityConfiguration" />
+
+ <bean id="shibboleth.BasicSignatureSigningConfiguration" abstract="true"
+ class="org.opensaml.xmlsec.impl.BasicSignatureSigningConfiguration"
+ p:includedAlgorithms="#{getObject('shibboleth.IncludedSignatureAlgorithms') ?: getObject('shibboleth.SignatureWhitelist')}"
+ p:excludedAlgorithms="#{getObject('shibboleth.ExcludedSignatureAlgorithms') ?: getObject('shibboleth.SignatureBlacklist')}" />
+
+ <bean id="shibboleth.BasicEncryptionConfiguration" abstract="true"
+ class="org.opensaml.xmlsec.impl.BasicEncryptionConfiguration"
+ p:includedAlgorithms="#{getObject('shibboleth.IncludedEncryptionAlgorithms') ?: getObject('shibboleth.EncryptionWhitelist')}"
+ p:excludedAlgorithms="#{getObject('shibboleth.ExcludedEncryptionAlgorithms') ?: getObject('shibboleth.EncryptionBlacklist')}" />
+
+ <bean id="shibboleth.BasicDecryptionConfiguration" abstract="true"
+ class="org.opensaml.xmlsec.impl.BasicDecryptionConfiguration"
+ p:includedAlgorithms="#{getObject('shibboleth.IncludedEncryptionAlgorithms') ?: getObject('shibboleth.EncryptionWhitelist')}"
+ p:excludedAlgorithms="#{getObject('shibboleth.ExcludedEncryptionAlgorithms') ?: getObject('shibboleth.EncryptionBlacklist')}" />
+
+ <!-- Lookup functions to locate security configurations on profile beans. -->
+
+ <bean id="shibboleth.SignatureValidationConfigurationLookup" lazy-init="true"
+ class="net.shibboleth.idp.profile.config.navigate.SignatureValidationConfigurationLookupFunction"
+ p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
+ <bean id="shibboleth.SignatureSigningConfigurationLookup" lazy-init="true"
+ class="net.shibboleth.idp.profile.config.navigate.SignatureSigningConfigurationLookupFunction"
+ p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
+ <bean id="shibboleth.DecryptionConfigurationLookup" lazy-init="true"
+ class="net.shibboleth.idp.profile.config.navigate.DecryptionConfigurationLookupFunction"
+ p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
+ <bean id="shibboleth.EncryptionConfigurationLookup" lazy-init="true"
+ class="net.shibboleth.idp.profile.config.navigate.EncryptionConfigurationLookupFunction"
+ p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
+ <bean id="shibboleth.ClientTLSValidationConfigurationLookup" lazy-init="true"
+ class="net.shibboleth.idp.profile.config.navigate.ClientTLSValidationConfigurationLookupFunction"
+ p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
+ <bean id="shibboleth.SelfEncryptionConfigurationLookup" lazy-init="true"
+ class="net.shibboleth.idp.profile.config.navigate.SelfEncryptionConfigurationLookupFunction"
+ p:selfConfiguration="#{getObject('shibboleth.SelfEncryptionConfiguration')}"
+ p:includeProfileDefaultConfiguration="%{idp.encryption.self.includeProfileDefaultConfiguration:false}"
+ p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
+
+ <!-- Beans that implement the mashing of security configurations into final parameter sets. -->
+
+ <bean id="shibboleth.SignatureValidationParametersResolver"
+ class="org.opensaml.xmlsec.impl.BasicSignatureValidationParametersResolver" />
+ <bean id="shibboleth.SignatureSigningParametersResolver"
+ class="org.opensaml.saml.security.impl.SAMLMetadataSignatureSigningParametersResolver" />
+ <bean id="shibboleth.DecryptionParametersResolver"
+ class="org.opensaml.xmlsec.impl.BasicDecryptionParametersResolver" />
+ <bean id="shibboleth.EncryptionParametersResolver"
+ class="org.opensaml.saml.security.impl.SAMLMetadataEncryptionParametersResolver"
+ c:resolver-ref="shibboleth.MetadataCredentialResolver" />
+ <bean id="shibboleth.ClientTLSValidationParametersResolver"
+ class="org.opensaml.security.x509.tls.impl.BasicClientTLSValidationParametersResolver" />
+ <bean id="shibboleth.HttpClientSecurityParametersResolver"
+ class="org.opensaml.security.httpclient.impl.BasicHttpClientSecurityParametersResolver" />
+
+ <!--
+ The beans below are primarily used by trust engines in relying-party-system.xml, but also in the
+ resolver for encryption parameters above.
+ -->
+
+ <bean id="shibboleth.MetadataCredentialResolver"
+ class="org.opensaml.saml.security.impl.MetadataCredentialResolver"
+ p:roleDescriptorResolver-ref="shibboleth.RoleDescriptorResolver"
+ p:keyInfoCredentialResolver-ref="shibboleth.KeyInfoCredentialResolver">
+ </bean>
+
+ <bean id="shibboleth.KeyInfoCredentialResolver"
+ class="org.opensaml.xmlsec.config.impl.DefaultSecurityConfigurationBootstrap"
+ factory-method="buildBasicInlineKeyInfoCredentialResolver" />
+
+ </beans>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list