[java-identity-provider] branch master updated: IDP-1553 - Deprecate HttpClient parent beans
Scott Cantor
cantor.2 at osu.edu
Mon Feb 17 15:41:42 EST 2020
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=48b0c6a76fbd45c164419317cd96bb610147a460
The following commit(s) were added to refs/heads/master by this push:
new 48b0c6a IDP-1553 - Deprecate HttpClient parent beans
48b0c6a is described below
commit 48b0c6a76fbd45c164419317cd96bb610147a460
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Feb 17 15:41:38 2020 -0500
IDP-1553 - Deprecate HttpClient parent beans
https://issues.shibboleth.net/jira/browse/IDP-1553
---
.../src/test/resources/spring/test-flow-beans.xml | 6 ++--
.../resources/system/conf/cas-protocol-system.xml | 2 +-
.../resources/system/conf/general-admin-system.xml | 2 +-
.../main/resources/system/conf/global-system.xml | 26 +++++++++++---
.../src/main/resources/system/conf/soap-client.xml | 2 +-
.../src/main/resources/system/conf/utilities.xml | 10 ++++++
.../system/flows/authn/duo-authn-beans.xml | 4 +--
.../impl/FileCachingHttpClientFactoryBean.java | 41 ++++++++++++++++++++++
.../metadata/impl/HttpClientFactoryBean.java | 40 +++++++++++++++++++++
.../impl/InMemoryCachingHttpClientFactoryBean.java | 40 +++++++++++++++++++++
10 files changed, 159 insertions(+), 14 deletions(-)
diff --git a/idp-cas-impl/src/test/resources/spring/test-flow-beans.xml b/idp-cas-impl/src/test/resources/spring/test-flow-beans.xml
index fc2140b..be597a5 100644
--- a/idp-cas-impl/src/test/resources/spring/test-flow-beans.xml
+++ b/idp-cas-impl/src/test/resources/spring/test-flow-beans.xml
@@ -144,9 +144,7 @@
</property>
</bean>
- <bean id="shibboleth.NonCachingHttpClient"
- lazy-init="true"
- class="net.shibboleth.idp.profile.spring.relyingparty.metadata.HttpClientFactoryBean"
+ <bean id="shibboleth.InternalHttpClient" parent="shibboleth.HttpClientFactory" lazy-init="true"
p:connectionDisregardTLSCertificate="false"
p:connectionTimeout="PT1M"
p:connectionRequestTimeout="PT1M"
@@ -159,7 +157,7 @@
class="org.opensaml.security.httpclient.impl.SecurityEnhancedHttpClientSupport"
factory-method="buildTLSSocketFactory" />
- <bean id="proxyHttpClient" parent="shibboleth.NonCachingHttpClient"
+ <bean id="proxyHttpClient" parent="shibboleth.InternalHttpClient"
p:tLSSocketFactory-ref="shibboleth.SecurityEnhancedTLSSocketFactory" />
<bean id="shibboleth.StaticPKIXTrustEngine" abstract="true"
diff --git a/idp-conf/src/main/resources/system/conf/cas-protocol-system.xml b/idp-conf/src/main/resources/system/conf/cas-protocol-system.xml
index 6ff1a36..9bda021 100644
--- a/idp-conf/src/main/resources/system/conf/cas-protocol-system.xml
+++ b/idp-conf/src/main/resources/system/conf/cas-protocol-system.xml
@@ -36,7 +36,7 @@
<alias name="simpleTicketService" alias="shibboleth.DefaultCASTicketService" />
- <bean id="proxyHttpClient" parent="shibboleth.NonCachingHttpClient"
+ <bean id="proxyHttpClient" parent="shibboleth.InternalHttpClient"
p:tLSSocketFactory-ref="shibboleth.SecurityEnhancedTLSSocketFactory" />
<bean id="proxyHttpSecurity" class="org.opensaml.security.httpclient.HttpClientSecurityParameters">
diff --git a/idp-conf/src/main/resources/system/conf/general-admin-system.xml b/idp-conf/src/main/resources/system/conf/general-admin-system.xml
index 14e973a..c577242 100644
--- a/idp-conf/src/main/resources/system/conf/general-admin-system.xml
+++ b/idp-conf/src/main/resources/system/conf/general-admin-system.xml
@@ -65,7 +65,7 @@
class="net.shibboleth.idp.metrics.impl.HTTPReporter"
c:registry-ref="shibboleth.metrics.MetricRegistry"
c:filter="#{null}"
- p:httpClient-ref="shibboleth.NonCachingHttpClient" />
+ p:httpClient-ref="shibboleth.InternalHttpClient" />
<!-- Some predefined metric sets, only created if installed by user. -->
diff --git a/idp-conf/src/main/resources/system/conf/global-system.xml b/idp-conf/src/main/resources/system/conf/global-system.xml
index b92a13f..8849e30 100644
--- a/idp-conf/src/main/resources/system/conf/global-system.xml
+++ b/idp-conf/src/main/resources/system/conf/global-system.xml
@@ -335,11 +335,11 @@
class="org.opensaml.xmlsec.config.impl.DefaultSecurityConfigurationBootstrap"
factory-method="buildBasicInlineKeyInfoCredentialResolver" />
- <!-- These are the common HttpClients wired to by multiple components, such as HTTPResources. -->
+ <!-- These are deprecated because using them triggers Spring bugs when contexts reload. -->
<bean id="shibboleth.NonCachingHttpClient"
lazy-init="true"
- class="net.shibboleth.idp.profile.spring.relyingparty.metadata.HttpClientFactoryBean"
+ class="net.shibboleth.idp.profile.spring.relyingparty.metadata.impl.HttpClientFactoryBean"
p:tLSSocketFactory="#{ %{idp.httpclient.useTrustEngineTLSSocketFactory:false} or %{idp.httpclient.useSecurityEnhancedTLSSocketFactory:false} ? @'shibboleth.SecurityEnhancedTLSSocketFactory' : null }"
p:connectionDisregardTLSCertificate="%{idp.httpclient.connectionDisregardTLSCertificate:false}"
p:connectionTimeout="%{idp.httpclient.connectionTimeout:PT1M}"
@@ -350,7 +350,7 @@
<bean id="shibboleth.FileCachingHttpClient"
lazy-init="true"
- class="net.shibboleth.idp.profile.spring.relyingparty.metadata.FileCachingHttpClientFactoryBean"
+ class="net.shibboleth.idp.profile.spring.relyingparty.metadata.impl.FileCachingHttpClientFactoryBean"
p:tLSSocketFactory="#{ %{idp.httpclient.useTrustEngineTLSSocketFactory:false} or %{idp.httpclient.useSecurityEnhancedTLSSocketFactory:false} ? @'shibboleth.SecurityEnhancedTLSSocketFactory' : null }"
p:connectionDisregardTLSCertificate="%{idp.httpclient.connectionDisregardTLSCertificate:false}"
p:connectionTimeout="%{idp.httpclient.connectionTimeout:PT1M}"
@@ -364,7 +364,7 @@
<bean id="shibboleth.MemoryCachingHttpClient"
lazy-init="true"
- class="net.shibboleth.idp.profile.spring.relyingparty.metadata.InMemoryCachingHttpClientFactoryBean"
+ class="net.shibboleth.idp.profile.spring.relyingparty.metadata.impl.InMemoryCachingHttpClientFactoryBean"
p:tLSSocketFactory="#{ %{idp.httpclient.useTrustEngineTLSSocketFactory:false} or %{idp.httpclient.useSecurityEnhancedTLSSocketFactory:false} ? @'shibboleth.SecurityEnhancedTLSSocketFactory' : null }"
p:connectionDisregardTLSCertificate="%{idp.httpclient.connectionDisregardTLSCertificate:false}"
p:connectionTimeout="%{idp.httpclient.connectionTimeout:PT1M}"
@@ -374,7 +374,23 @@
p:maxConnectionsPerRoute="%{idp.httpclient.maxConnectionsPerRoute:100}"
p:maxCacheEntries="%{idp.httpclient.memorycaching.maxCacheEntries:50}"
p:maxCacheEntrySize="%{idp.httpclient.memorycaching.maxCacheEntrySize:1048576}" />
-
+
+ <!-- Back to non-deprecated beans. -->
+
+ <!--
+ This is a default client for embedded system use but should NOT be used by deployers OR
+ within the IdP within any reloadable service child contexts.
+ -->
+
+ <bean id="shibboleth.InternalHttpClient" parent="shibboleth.HttpClientFactory" lazy-init="true"
+ p:tLSSocketFactory="#{ %{idp.httpclient.useTrustEngineTLSSocketFactory:false} or %{idp.httpclient.useSecurityEnhancedTLSSocketFactory:false} ? @'shibboleth.SecurityEnhancedTLSSocketFactory' : null }"
+ p:connectionDisregardTLSCertificate="%{idp.httpclient.connectionDisregardTLSCertificate:false}"
+ p:connectionTimeout="%{idp.httpclient.connectionTimeout:PT1M}"
+ p:connectionRequestTimeout="%{idp.httpclient.connectionRequestTimeout:PT1M}"
+ p:socketTimeout="%{idp.httpclient.socketTimeout:PT1M}"
+ p:maxConnectionsTotal="%{idp.httpclient.maxConnectionsTotal:100}"
+ p:maxConnectionsPerRoute="%{idp.httpclient.maxConnectionsPerRoute:100}" />
+
<bean id="shibboleth.SecurityEnhancedTLSSocketFactory" name="shibboleth.TrustEngineTLSSocketFactory"
lazy-init="true"
class="org.opensaml.security.httpclient.impl.SecurityEnhancedHttpClientSupport"
diff --git a/idp-conf/src/main/resources/system/conf/soap-client.xml b/idp-conf/src/main/resources/system/conf/soap-client.xml
index ac5d0b4..718d8e5 100644
--- a/idp-conf/src/main/resources/system/conf/soap-client.xml
+++ b/idp-conf/src/main/resources/system/conf/soap-client.xml
@@ -178,7 +178,7 @@
class="org.opensaml.messaging.handler.impl.URLEvaluatingMessageChannelSecurity" scope="prototype"
p:URLLookup-ref="SOAPClient.DestinationURILookup" />
- <bean id="SOAPClient.HttpClient" parent="shibboleth.NonCachingHttpClient"
+ <bean id="SOAPClient.HttpClient" parent="shibboleth.InternalHttpClient"
p:tLSSocketFactory-ref="shibboleth.SecurityEnhancedTLSSocketFactoryWithClientTLS" />
<bean id="SOAPClient.ClientTLSPredicate"
diff --git a/idp-conf/src/main/resources/system/conf/utilities.xml b/idp-conf/src/main/resources/system/conf/utilities.xml
index 532e842..c387bc7 100644
--- a/idp-conf/src/main/resources/system/conf/utilities.xml
+++ b/idp-conf/src/main/resources/system/conf/utilities.xml
@@ -19,6 +19,16 @@
<bean id="shibboleth.NonFailFastValidator"
class="net.shibboleth.idp.attribute.resolver.dc.NonFailFastValidator" lazy-init="true" />
+
+ <!-- These are parent beans for custom HTTP clients. -->
+
+ <bean id="shibboleth.HttpClientFactory" abstract="true"
+ class="net.shibboleth.idp.profile.spring.relyingparty.metadata.HttpClientFactoryBean" />
+ <bean id="shibboleth.FileCachingHttpClientFactory" abstract="true"
+ class="net.shibboleth.idp.profile.spring.relyingparty.metadata.FileCachingHttpClientFactoryBean" />
+ <bean id="shibboleth.MemoryCachingHttpClientFactory" abstract="true"
+ class="net.shibboleth.idp.profile.spring.relyingparty.metadata.InMemoryCachingHttpClientFactoryBean" />
+
<bean id="shibboleth.Conditions.FALSE"
class="com.google.common.base.Predicates" factory-method="alwaysFalse" />
diff --git a/idp-conf/src/main/resources/system/flows/authn/duo-authn-beans.xml b/idp-conf/src/main/resources/system/flows/authn/duo-authn-beans.xml
index c060fb6..c36d97a 100644
--- a/idp-conf/src/main/resources/system/flows/authn/duo-authn-beans.xml
+++ b/idp-conf/src/main/resources/system/flows/authn/duo-authn-beans.xml
@@ -63,13 +63,13 @@
<bean id="DuoPreauthAuthenticator" lazy-init="true"
class="net.shibboleth.idp.authn.duo.impl.DuoPreauthAuthenticator"
p:objectMapper-ref="shibboleth.JSONObjectMapper"
- p:httpClient="#{getObject('shibboleth.authn.Duo.NonBrowser.HttpClient') ?: getObject('shibboleth.NonCachingHttpClient')}"
+ p:httpClient="#{getObject('shibboleth.authn.Duo.NonBrowser.HttpClient') ?: getObject('shibboleth.InternalHttpClient')}"
p:httpClientSecurityParameters="#{getObject('shibboleth.authn.Duo.NonBrowser.HttpClientSecurityParameters')}" />
<bean id="DuoAuthAuthenticator" lazy-init="true"
class="net.shibboleth.idp.authn.duo.impl.DuoAuthAuthenticator"
p:objectMapper-ref="shibboleth.JSONObjectMapper"
- p:httpClient="#{getObject('shibboleth.authn.Duo.NonBrowser.HttpClient') ?: getObject('shibboleth.NonCachingHttpClient')}"
+ p:httpClient="#{getObject('shibboleth.authn.Duo.NonBrowser.HttpClient') ?: getObject('shibboleth.InternalHttpClient')}"
p:httpClientSecurityParameters="#{getObject('shibboleth.authn.Duo.NonBrowser.HttpClientSecurityParameters')}" />
<util:map id="shibboleth.authn.Duo.DefaultClassifiedMessageMap">
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/impl/FileCachingHttpClientFactoryBean.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/impl/FileCachingHttpClientFactoryBean.java
new file mode 100644
index 0000000..987504e
--- /dev/null
+++ b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/impl/FileCachingHttpClientFactoryBean.java
@@ -0,0 +1,41 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.profile.spring.relyingparty.metadata.impl;
+
+import net.shibboleth.utilities.java.support.primitive.DeprecationSupport;
+import net.shibboleth.utilities.java.support.primitive.DeprecationSupport.ObjectType;
+
+/**
+ * Factory bean customization for the Shibboleth IdP.
+ *
+ * @deprecated
+ */
+ at Deprecated(forRemoval=true, since="4.0.0")
+public class FileCachingHttpClientFactoryBean
+ extends net.shibboleth.ext.spring.factory.FileCachingHttpClientFactoryBean {
+
+ /**
+ * Constructor.
+ *
+ */
+ public FileCachingHttpClientFactoryBean() {
+ DeprecationSupport.warn(ObjectType.BEAN, "shibboleth.FileCachingHttpClient", null,
+ "shibboleth.FileCachingHttpClientFactory");
+ }
+
+}
\ No newline at end of file
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/impl/HttpClientFactoryBean.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/impl/HttpClientFactoryBean.java
new file mode 100644
index 0000000..41f2ca2
--- /dev/null
+++ b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/impl/HttpClientFactoryBean.java
@@ -0,0 +1,40 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.profile.spring.relyingparty.metadata.impl;
+
+import net.shibboleth.utilities.java.support.primitive.DeprecationSupport;
+import net.shibboleth.utilities.java.support.primitive.DeprecationSupport.ObjectType;
+
+/**
+ * Factory bean customization for the Shibboleth IdP.
+ *
+ * @deprecated
+ */
+ at Deprecated(forRemoval=true, since="4.0.0")
+public class HttpClientFactoryBean
+ extends net.shibboleth.idp.profile.spring.relyingparty.metadata.HttpClientFactoryBean {
+
+ /**
+ * Constructor.
+ */
+ public HttpClientFactoryBean() {
+ DeprecationSupport.warn(ObjectType.BEAN, "shibboleth.NonCachingHttpClient", null,
+ "shibboleth.HttpClientFactory");
+ }
+
+}
\ No newline at end of file
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/impl/InMemoryCachingHttpClientFactoryBean.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/impl/InMemoryCachingHttpClientFactoryBean.java
new file mode 100644
index 0000000..d1b2b4b
--- /dev/null
+++ b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/impl/InMemoryCachingHttpClientFactoryBean.java
@@ -0,0 +1,40 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.profile.spring.relyingparty.metadata.impl;
+
+import net.shibboleth.utilities.java.support.primitive.DeprecationSupport;
+import net.shibboleth.utilities.java.support.primitive.DeprecationSupport.ObjectType;
+
+/**
+ * Factory bean customization for the Shibboleth IdP.
+ *
+ * @deprecated
+ */
+ at Deprecated(forRemoval=true, since="4.0.0")
+public class InMemoryCachingHttpClientFactoryBean
+ extends net.shibboleth.idp.profile.spring.relyingparty.metadata.InMemoryCachingHttpClientFactoryBean {
+
+ /**
+ * Constructor.
+ */
+ public InMemoryCachingHttpClientFactoryBean() {
+ DeprecationSupport.warn(ObjectType.BEAN, "shibboleth.MemoryCachingHttpClient", null,
+ "shibboleth.MemoryCachingHttpClientFactory");
+ }
+
+}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list