[java-identity-provider] branch master updated: IDP-1642 - Migrate configuration into jars where feasible
Scott Cantor
cantor.2 at osu.edu
Thu Jul 30 13:45:32 UTC 2020
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=219b7bb2b0ed48c4f83a40c5b0e06969c8ea46f3
The following commit(s) were added to refs/heads/master by this push:
new 219b7bb2b IDP-1642 - Migrate configuration into jars where feasible
219b7bb2b is described below
commit 219b7bb2b0ed48c4f83a40c5b0e06969c8ea46f3
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Jul 30 09:45:54 2020 -0400
IDP-1642 - Migrate configuration into jars where feasible
https://issues.shibboleth.net/jira/browse/IDP-1642
Move configuration into idp-conf-impl
---
.../net/shibboleth/idp}/conf/audit-system.xml | 2 +-
.../shibboleth/idp}/conf/cas-protocol-system.xml | 2 +-
.../shibboleth/idp}/conf/general-admin-system.xml | 4 +-
.../shibboleth/idp}/conf/general-authn-system.xml | 4 +-
.../net/shibboleth/idp}/conf/global-system.xml | 4 +-
.../idp}/conf/profile-intercept-system.xml | 2 +-
.../shibboleth/idp}/conf/saml-binding-config.xml | 0
.../net/shibboleth/idp}/conf/services-system.xml | 2 +-
.../idp}/conf/session-manager-system.xml | 2 +-
.../net/shibboleth/idp}/conf/soap-client.xml | 0
.../shibboleth/idp}/conf/subject-c14n-system.xml | 2 +-
.../net/shibboleth/idp}/conf/utilities.xml | 0
.../main/resources/system/conf/global-system.xml | 509 +--------------------
...IdPPropertiesApplicationContextInitializer.java | 7 +
14 files changed, 21 insertions(+), 519 deletions(-)
diff --git a/idp-conf/src/main/resources/system/conf/audit-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/audit-system.xml
similarity index 99%
rename from idp-conf/src/main/resources/system/conf/audit-system.xml
rename to idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/audit-system.xml
index ebc45155a..6cfbf2f21 100644
--- a/idp-conf/src/main/resources/system/conf/audit-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/audit-system.xml
@@ -95,7 +95,7 @@
The actual beans used are in user-space, but they inherit from the maps below. We have to use a
MapFactoryBean instead of util:map because merging isn't supported by the util:map schema.
-->
- <import resource="../../conf/audit.xml"/>
+ <import resource="${idp.home}/conf/audit.xml"/>
<bean id="shibboleth.DefaultFlowStartAuditExtractors" lazy-init="true"
class="org.springframework.beans.factory.config.MapFactoryBean">
diff --git a/idp-conf/src/main/resources/system/conf/cas-protocol-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/cas-protocol-system.xml
similarity index 98%
rename from idp-conf/src/main/resources/system/conf/cas-protocol-system.xml
rename to idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/cas-protocol-system.xml
index 9bda021a1..555bc98c3 100644
--- a/idp-conf/src/main/resources/system/conf/cas-protocol-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/cas-protocol-system.xml
@@ -82,6 +82,6 @@
<util:list id="shibboleth.DefaultCASProxyTrustedCertificates" />
- <import resource="../../conf/cas-protocol.xml" />
+ <import resource="${idp.home}/conf/cas-protocol.xml" />
</beans>
diff --git a/idp-conf/src/main/resources/system/conf/general-admin-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/general-admin-system.xml
similarity index 97%
rename from idp-conf/src/main/resources/system/conf/general-admin-system.xml
rename to idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/general-admin-system.xml
index 7b782b6b2..7f78e7530 100644
--- a/idp-conf/src/main/resources/system/conf/general-admin-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/general-admin-system.xml
@@ -12,8 +12,8 @@
default-init-method="initialize"
default-destroy-method="destroy">
- <import resource="../../conf/admin/general-admin.xml" />
- <import resource="../../conf/admin/metrics.xml" />
+ <import resource="${idp.home}/conf/admin/general-admin.xml" />
+ <import resource="${idp.home}/conf/admin/metrics.xml" />
<import resource="conditional:${idp.home}/conf/admin/unlock-keys.xml" />
<!-- Parent beans to default some of the flow boilerplate. -->
diff --git a/idp-conf/src/main/resources/system/conf/general-authn-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/general-authn-system.xml
similarity index 98%
rename from idp-conf/src/main/resources/system/conf/general-authn-system.xml
rename to idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/general-authn-system.xml
index affb4a0a0..b89caf8e9 100644
--- a/idp-conf/src/main/resources/system/conf/general-authn-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/general-authn-system.xml
@@ -12,8 +12,8 @@
default-init-method="initialize"
default-destroy-method="destroy">
- <import resource="../../conf/authn/authn-comparison.xml" />
- <import resource="../../conf/authn/general-authn.xml" />
+ <import resource="${idp.home}/conf/authn/authn-comparison.xml" />
+ <import resource="${idp.home}/conf/authn/general-authn.xml" />
<!-- A parent bean to default some of the flow boilerplate. -->
diff --git a/idp-conf/src/main/resources/system/conf/global-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/global-system.xml
similarity index 99%
copy from idp-conf/src/main/resources/system/conf/global-system.xml
copy to idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/global-system.xml
index a6b6954c9..d161b7d83 100644
--- a/idp-conf/src/main/resources/system/conf/global-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/global-system.xml
@@ -50,8 +50,8 @@
p:basenames-ref="ExtendedMessageSourceResources"
p:defaultEncoding="UTF-8" />
- <import resource="../../conf/global.xml" />
- <import resource="../../conf/errors.xml" />
+ <import resource="${idp.home}/conf/global.xml" />
+ <import resource="${idp.home}/conf/errors.xml" />
<import resource="audit-system.xml" />
<import resource="general-authn-system.xml" />
<import resource="session-manager-system.xml" />
diff --git a/idp-conf/src/main/resources/system/conf/profile-intercept-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/profile-intercept-system.xml
similarity index 99%
rename from idp-conf/src/main/resources/system/conf/profile-intercept-system.xml
rename to idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/profile-intercept-system.xml
index 0c70290ac..0f41497ff 100644
--- a/idp-conf/src/main/resources/system/conf/profile-intercept-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/profile-intercept-system.xml
@@ -12,7 +12,7 @@
default-init-method="initialize"
default-destroy-method="destroy">
- <import resource="../../conf/intercept/profile-intercept.xml" />
+ <import resource="${idp.home}/conf/intercept/profile-intercept.xml" />
<!-- Parent bean for intercept interceptor flows. -->
<bean id="shibboleth.InterceptFlow" abstract="true"
diff --git a/idp-conf/src/main/resources/system/conf/saml-binding-config.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/saml-binding-config.xml
similarity index 100%
rename from idp-conf/src/main/resources/system/conf/saml-binding-config.xml
rename to idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/saml-binding-config.xml
diff --git a/idp-conf/src/main/resources/system/conf/services-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/services-system.xml
similarity index 99%
rename from idp-conf/src/main/resources/system/conf/services-system.xml
rename to idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/services-system.xml
index 854d111d2..0b3b3289d 100644
--- a/idp-conf/src/main/resources/system/conf/services-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/services-system.xml
@@ -12,7 +12,7 @@
default-init-method="initialize"
default-destroy-method="destroy">
- <import resource="../../conf/services.xml" />
+ <import resource="${idp.home}/conf/services.xml" />
<!--
These are beans that define reloadable services. The actual Spring resources that configure the
diff --git a/idp-conf/src/main/resources/system/conf/session-manager-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/session-manager-system.xml
similarity index 98%
rename from idp-conf/src/main/resources/system/conf/session-manager-system.xml
rename to idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/session-manager-system.xml
index 144afa6cc..c0136b776 100644
--- a/idp-conf/src/main/resources/system/conf/session-manager-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/session-manager-system.xml
@@ -91,6 +91,6 @@
c:flows-ref="shibboleth.LogoutPropagationFlows" />
<!-- The import is at the bottom to avoid a depends-on in a user-editable file. -->
- <import resource="../../conf/session-manager.xml" />
+ <import resource="${idp.home}/conf/session-manager.xml" />
</beans>
diff --git a/idp-conf/src/main/resources/system/conf/soap-client.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/soap-client.xml
similarity index 100%
rename from idp-conf/src/main/resources/system/conf/soap-client.xml
rename to idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/soap-client.xml
diff --git a/idp-conf/src/main/resources/system/conf/subject-c14n-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/subject-c14n-system.xml
similarity index 98%
rename from idp-conf/src/main/resources/system/conf/subject-c14n-system.xml
rename to idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/subject-c14n-system.xml
index 8a0b52557..9318013af 100644
--- a/idp-conf/src/main/resources/system/conf/subject-c14n-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/subject-c14n-system.xml
@@ -16,7 +16,7 @@
<bean id="shibboleth.ProxyNameTransformPredicate" parent="shibboleth.Conditions.FALSE" />
<util:list id="shibboleth.ProxyNameTransformFormats" />
- <import resource="../../conf/c14n/subject-c14n.xml" />
+ <import resource="${idp.home}/conf/c14n/subject-c14n.xml" />
<bean id="shibboleth.PostLoginSubjectCanonicalizationFlow" abstract="true"
class="net.shibboleth.idp.authn.SubjectCanonicalizationFlowDescriptor" />
diff --git a/idp-conf/src/main/resources/system/conf/utilities.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/utilities.xml
similarity index 100%
rename from idp-conf/src/main/resources/system/conf/utilities.xml
rename to idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/utilities.xml
diff --git a/idp-conf/src/main/resources/system/conf/global-system.xml b/idp-conf/src/main/resources/system/conf/global-system.xml
index a6b6954c9..3a81eb4a4 100644
--- a/idp-conf/src/main/resources/system/conf/global-system.xml
+++ b/idp-conf/src/main/resources/system/conf/global-system.xml
@@ -12,513 +12,8 @@
default-init-method="initialize"
default-destroy-method="destroy">
- <bean id="shibboleth.PropertySourcesPlaceholderConfigurer"
- class="org.springframework.context.support.PropertySourcesPlaceholderConfigurer"
- p:placeholderPrefix="%{" p:placeholderSuffix="}" />
-
- <!-- This bean MUST be called "conversionService" to work properly. -->
- <bean id="conversionService" class="org.springframework.context.support.ConversionServiceFactoryBean">
- <property name="converters">
- <set>
- <bean class="net.shibboleth.ext.spring.config.StringToIPRangeConverter" />
- <bean class="net.shibboleth.ext.spring.config.BooleanToPredicateConverter" />
- <bean class="net.shibboleth.ext.spring.config.StringBooleanToPredicateConverter" />
- <bean class="net.shibboleth.ext.spring.config.StringToResourceConverter" />
- <bean class="net.shibboleth.ext.spring.config.FunctionToFunctionConverter" />
- <bean class="net.shibboleth.ext.spring.config.PredicateToPredicateConverter" />
- <bean class="net.shibboleth.ext.spring.config.StringToDurationConverter" />
- </set>
- </property>
- </bean>
-
- <!-- This BeanPostProcessor auto-sets identifiable beans with the bean name (if not already set). -->
- <bean id="shibboleth.IdentifiableBeanPostProcessor"
- class="net.shibboleth.ext.spring.config.IdentifiableBeanPostProcessor" />
-
- <!-- This extends the original user-space resource list with the classpath-embedded message tree. -->
- <bean id ="ExtendedMessageSourceResources" class="net.shibboleth.ext.spring.factory.CombiningListFactoryBean"
- p:firstList-ref="#{'%{idp.message.resources:shibboleth.MessageSourceResources}'.trim()}" >
- <property name="secondList">
- <util:list >
- <value>classpath:/net/shibboleth/idp/messages/messages</value>
- </util:list>
- </property>
- </bean>
-
- <bean id="messageSource" class="org.springframework.context.support.ReloadableResourceBundleMessageSource"
- p:cacheSeconds="%{idp.message.cacheSeconds:300}"
- p:basenames-ref="ExtendedMessageSourceResources"
- p:defaultEncoding="UTF-8" />
-
- <import resource="../../conf/global.xml" />
- <import resource="../../conf/errors.xml" />
- <import resource="audit-system.xml" />
- <import resource="general-authn-system.xml" />
- <import resource="session-manager-system.xml" />
- <import resource="services-system.xml" />
- <import resource="saml-binding-config.xml" />
- <import resource="subject-c14n-system.xml" />
- <import resource="profile-intercept-system.xml" />
- <import resource="cas-protocol-system.xml" />
- <import resource="general-admin-system.xml" />
- <import resource="utilities.xml" />
- <import resource="soap-client.xml" />
-
- <bean id="systemPrereqs" class="org.springframework.beans.factory.config.MethodInvokingBean"
- p:targetObject-ref="systemProperties" p:targetMethod="putAll">
- <property name="arguments">
- <props>
- <prop key="org.apache.xml.security.ignoreLineBreaks">%{idp.apache.xml.security.ignoreLineBreaks:true}</prop>
- </props>
- </property>
- </bean>
-
- <bean id="shibboleth.OpenSAMLConfig" class="net.shibboleth.idp.spring.OpenSAMLConfigBean"
- depends-on="systemPrereqs,shibboleth.LoggingService"
- p:parserPool-ref="shibboleth.ParserPool"
- p:metricRegistry-ref="shibboleth.metrics.MetricRegistry" />
-
- <bean class="net.shibboleth.idp.spring.DeprecatedPropertyBean">
- <property name="deprecatedProperties">
- <map>
- <entry key="idp.httpclient.useTrustEngineTLSSocketFactory" value="idp.httpclient.useSecurityEnhancedTLSSocketFactory" />
- <entry key="idp.xml.securityManager">
- <null/>
- </entry>
- <entry key="idp.consent.userStorageKey" value="idp.consent.attribute-release.userStorageKey" />
- <entry key="idp.consent.userStorageKeyAttribute" value="idp.consent.attribute-release.userStorageKeyAttribute" />
- <entry key="idp.persistentId.store" value="idp.persistentId.generator" />
- </map>
- </property>
- <property name="deadProperties">
- <list>
- <value>idp.authn.flows.initial</value>
- <value>idp.authn.resolveAttribute</value>
- <value>idp.nameid.saml1.legacyGenerator</value>
- <value>idp.nameid.saml2.legacyGenerator</value>
- </list>
- </property>
- </bean>
-
- <util:map id="shibboleth.DefaultVelocityEngineProperties">
- <entry key="parser.space_gobbling" value="%{idp.velocity.space.gobbling:bc}" />
- <entry key="resource.loaders" value="file, classpath, string" />
- <entry key="resource.loader.classpath.class" value="org.apache.velocity.runtime.resource.loader.ClasspathResourceLoader" />
- <entry key="resource.loader.string.class" value="org.apache.velocity.runtime.resource.loader.StringResourceLoader" />
- <entry key="resource.loader.file.class" value="org.apache.velocity.runtime.resource.loader.FileResourceLoader" />
- <entry key="resource.loader.file.path" value="#{'%{idp.views:%{idp.home}/views}'.trim()}" />
- <entry key="resource.loader.file.cache" value="false" />
- </util:map>
-
- <bean id="shibboleth.VelocityEngine" class="net.shibboleth.ext.spring.velocity.VelocityEngineFactoryBean"
- depends-on="shibboleth.LoggingService"
- p:velocityPropertiesMap="#{getObject('shibboleth.VelocityEngineProperties') ?: getObject('shibboleth.DefaultVelocityEngineProperties')}" />
-
- <alias name="%{idp.xml.parserPool:shibboleth.DefaultParserPool}" alias="shibboleth.ParserPool"/>
-
- <bean id="shibboleth.DefaultParserPool" class="net.shibboleth.utilities.java.support.xml.BasicParserPool"
- depends-on="shibboleth.LoggingService" lazy-init="true"
- p:maxPoolSize="100"
- p:coalescing="true"
- p:ignoreComments="true"
- p:ignoreElementContentWhitespace="true"
- p:namespaceAware="true"
- p:securityManagerAttributeName="http://apache.org/xml/properties/security-manager">
- <property name="builderFeatures">
- <map>
- <entry key="http://apache.org/xml/features/disallow-doctype-decl">
- <util:constant static-field="java.lang.Boolean.TRUE" />
- </entry>
- <entry key="http://apache.org/xml/features/validation/schema/normalized-value">
- <util:constant static-field="java.lang.Boolean.FALSE" />
- </entry>
- <entry key="http://javax.xml.XMLConstants/feature/secure-processing">
- <util:constant static-field="java.lang.Boolean.TRUE" />
- </entry>
- </map>
- </property>
- </bean>
-
- <!-- Bean used by the SchemaValidation metadata filter and anything else doing basic schema validation. -->
- <bean id="shibboleth.SchemaBuilder" lazy-init="true"
- class="org.opensaml.saml.common.xml.SAMLSchemaBuilder" c:ver="SAML_11" c:strict="%{idp.schemaValidation.strict:false}">
- <property name="schemaBuilder">
- <bean class="net.shibboleth.utilities.java.support.xml.SchemaBuilder">
- <property name="resourceResolver">
- <bean class="net.shibboleth.utilities.java.support.xml.ClasspathResolver" />
- </property>
- <property name="schemaResources">
- <list>
- <value>#{'classpath:' + T(org.opensaml.saml.common.xml.SAMLConstants).XMLSIG_SCHEMA_LOCATION }</value>
- <value>#{'classpath:' + T(net.shibboleth.idp.saml.xmlobject.ExtensionsConstants).SHIB_MDEXT10_SCHEMA_LOCATION }</value>
- </list>
- </property>
- </bean>
- </property>
- </bean>
-
- <bean id="shibboleth.HttpServletRequest" class="net.shibboleth.utilities.java.support.net.ThreadLocalHttpServletRequestProxy" />
- <bean id="shibboleth.HttpServletResponse" class="net.shibboleth.utilities.java.support.net.ThreadLocalHttpServletResponseProxy" />
-
- <bean id="shibboleth.DefaultResponseHeaderMap"
- class="org.springframework.beans.factory.config.MapFactoryBean">
- <property name="sourceMap">
- <map>
- <entry key="Strict-Transport-Security" value="%{idp.hsts:max-age=0}" />
- <entry key="X-Frame-Options" value="%{idp.frameoptions:DENY}" />
- <entry key="Content-Security-Policy" value="%{idp.csp:frame-ancestors 'none';}"/>
- </map>
- </property>
- </bean>
-
- <bean id="shibboleth.ResponseHeaderFilter"
- class="net.shibboleth.utilities.java.support.net.DynamicResponseHeaderFilter"
- p:headers="#{getObject('shibboleth.ResponseHeaderMap') ?: getObject('shibboleth.DefaultResponseHeaderMap')}"
- p:callbacks="#{getObject('shibboleth.ResponseHeaderCallbacks')}" />
-
- <bean id="shibboleth.SameSiteCookieFilter"
- class="net.shibboleth.utilities.java.support.net.SameSiteCookieHeaderFilter"
- p:activationCondition-ref="#{'%{idp.cookie.sameSiteCondition:shibboleth.Conditions.FALSE}'.trim()}"
- p:defaultValue="%{idp.cookie.sameSite:None}"
- p:sameSiteCookies="#{getObject('shibboleth.SameSiteCookieMap')}" />
-
- <bean id="shibboleth.BuilderFactory" factory-method="getBuilderFactory" class="org.opensaml.core.xml.config.XMLObjectProviderRegistrySupport" depends-on="shibboleth.OpenSAMLConfig" />
- <bean id="shibboleth.MarshallerFactory" factory-method="getMarshallerFactory" class="org.opensaml.core.xml.config.XMLObjectProviderRegistrySupport" depends-on="shibboleth.OpenSAMLConfig" />
- <bean id="shibboleth.UnmarshallerFactory" factory-method="getUnmarshallerFactory" class="org.opensaml.core.xml.config.XMLObjectProviderRegistrySupport" depends-on="shibboleth.OpenSAMLConfig" />
-
- <bean id="shibboleth.CookieManager" class="net.shibboleth.utilities.java.support.net.CookieManager"
- p:httpServletRequest-ref="shibboleth.HttpServletRequest"
- p:httpServletResponse-ref="shibboleth.HttpServletResponse"
- p:secure="%{idp.cookie.secure:true}"
- p:httpOnly="%{idp.cookie.httpOnly:true}"
- p:cookieDomain="%{idp.cookie.domain:}"
- p:cookiePath="%{idp.cookie.path:}"
- p:maxAge="-1" />
-
- <bean id="shibboleth.PersistentCookieManager" class="net.shibboleth.utilities.java.support.net.CookieManager"
- p:httpServletRequest-ref="shibboleth.HttpServletRequest"
- p:httpServletResponse-ref="shibboleth.HttpServletResponse"
- p:secure="%{idp.cookie.secure:true}"
- p:httpOnly="%{idp.cookie.httpOnly:true}"
- p:cookieDomain="%{idp.cookie.domain:}"
- p:cookiePath="%{idp.cookie.path:}"
- p:maxAge="%{idp.cookie.maxAge:31536000}" />
-
- <bean id="shibboleth.UserPrefsCookieManager" class="net.shibboleth.utilities.java.support.net.CookieManager"
- p:httpServletRequest-ref="shibboleth.HttpServletRequest"
- p:httpServletResponse-ref="shibboleth.HttpServletResponse"
- p:secure="%{idp.cookie.secure:true}"
- p:httpOnly="false"
- p:cookieDomain="%{idp.cookie.domain:}"
- p:cookiePath="%{idp.cookie.path:}"
- p:maxAge="%{idp.cookie.maxAge:31536000}" />
-
- <bean id="shibboleth.DataSealerKeyStrategy" lazy-init="true"
- class="net.shibboleth.utilities.java.support.security.impl.BasicKeystoreKeyStrategy"
- p:keystoreType="%{idp.sealer.storeType:JCEKS}"
- p:keystoreResource="%{idp.sealer.storeResource:}"
- p:keyVersionResource="%{idp.sealer.versionResource:}"
- p:keyAlias="%{idp.sealer.aliasBase:secret}"
- p:keystorePassword="%{idp.sealer.storePassword:}"
- p:keyPassword="%{idp.sealer.keyPassword:}"
- p:updateInterval="%{idp.sealer.updateInterval:PT15M}" />
-
- <bean id="shibboleth.DataSealer" lazy-init="true"
- class="net.shibboleth.utilities.java.support.security.DataSealer"
- p:keyStrategy-ref="#{ '%{idp.sealer.keyStrategy:shibboleth.DataSealerKeyStrategy}'.trim() }"
- p:lockedAtStartup="#{!systemProperties.contains('idp.sealer.keyStrategy') and (!systemProperties.contains('idp.sealer.storePassword') or !systemProperties.contains('idp.sealer.keyPassword')) }" />
-
- <!-- This is a convenience for compatibility with the examples for configuring this in V2. -->
- <alias name="shibboleth.DataSealer" alias="shibboleth.TransientIDDataSealer"/>
-
- <bean id="shibboleth.StorageService" lazy-init="true"
- class="%{idp.storage.StorageService:org.opensaml.storage.impl.MemoryStorageService}"
- p:cleanupInterval="%{idp.storage.cleanupInterval:PT10M}" />
-
- <bean id="shibboleth.ClientSessionStorageService" lazy-init="true"
- class="org.opensaml.storage.impl.client.ClientStorageService"
- p:httpServletRequest-ref="shibboleth.HttpServletRequest"
- p:cookieManager-ref="shibboleth.CookieManager"
- p:storageName="%{idp.storage.clientSessionStorageName:shib_idp_session_ss}"
- p:dataSealer-ref="shibboleth.DataSealer" />
-
- <bean id="shibboleth.ClientPersistentStorageService" lazy-init="true"
- class="org.opensaml.storage.impl.client.ClientStorageService"
- p:httpServletRequest-ref="shibboleth.HttpServletRequest"
- p:cookieManager-ref="shibboleth.PersistentCookieManager"
- p:storageName="%{idp.storage.clientPersistentStorageName:shib_idp_persistent_ss}"
- p:dataSealer-ref="shibboleth.DataSealer"
- p:keyStrategy-ref="#{ '%{idp.sealer.keyStrategy:shibboleth.DataSealerKeyStrategy}'.trim() }" />
-
- <!--
- Default list of ClientStorageService plugins needed for injection into storage read/write flows.
- Declared here for compatibility with pre-3.2 installs that don't declare this list inside
- session-manager.xml
- -->
- <bean id="shibboleth.DefaultClientStorageServices" lazy-init="true"
- class="org.springframework.beans.factory.config.ListFactoryBean">
- <property name="sourceList">
- <list>
- <ref bean="shibboleth.ClientSessionStorageService" />
- <ref bean="shibboleth.ClientPersistentStorageService" />
- </list>
- </property>
- </bean>
-
- <bean id="shibboleth.ReplayCache" class="org.opensaml.storage.ReplayCache"
- p:storage-ref="#{'%{idp.replayCache.StorageService:shibboleth.StorageService}'.trim()}"
- p:strict="%{idp.replayCache.strict:true}" />
-
- <bean id="shibboleth.SAMLArtifactMap" depends-on="shibboleth.StorageService"
- class="org.opensaml.saml.common.binding.artifact.impl.StorageServiceSAMLArtifactMap"
- p:storageService-ref="#{'%{idp.artifact.StorageService:shibboleth.StorageService}'.trim()}" />
-
- <bean id="shibboleth.DefaultIdentifierGenerationStrategy"
- class="net.shibboleth.utilities.java.support.security.impl.SecureRandomIdentifierGenerationStrategy" />
-
- <bean id="shibboleth.StorageBackedAccountLockoutManager" abstract="true"
- class="net.shibboleth.idp.authn.impl.StorageBackedAccountLockoutManager"
- p:storageService-ref="shibboleth.StorageService">
- <property name="lockoutKeyStrategy">
- <bean class="net.shibboleth.idp.authn.impl.StorageBackedAccountLockoutManager.UsernameIPLockoutKeyStrategy"
- p:httpServletRequest-ref="shibboleth.HttpServletRequest" />
- </property>
- </bean>
-
- <!-- Parent beans for Signature/Encryption/TLS/HttpClientSecurity Configuration objects. -->
-
- <bean class="net.shibboleth.ext.spring.util.DeprecatedBeanDetector" c:_1="global.xml">
- <constructor-arg index="0">
- <map>
- <entry key="shibboleth.SignatureWhitelist" value="shibboleth.IncludedSignatureAlgorithms" />
- <entry key="shibboleth.SignatureBlacklist" value="shibboleth.ExcludedSignatureAlgorithms" />
- <entry key="shibboleth.EncryptionWhitelist" value="shibboleth.IncludedEncryptionAlgorithms" />
- <entry key="shibboleth.EncryptionBlacklist" value="shibboleth.ExcludedEncryptionAlgorithms" />
- </map>
- </constructor-arg>
- </bean>
-
- <bean id="shibboleth.BasicSignatureValidationConfiguration" abstract="true"
- class="org.opensaml.xmlsec.impl.BasicSignatureValidationConfiguration"
- p:includedAlgorithms="#{getObject('shibboleth.IncludedSignatureAlgorithms') ?: getObject('shibboleth.SignatureWhitelist')}"
- p:excludedAlgorithms="#{getObject('shibboleth.ExcludedSignatureAlgorithms') ?: getObject('shibboleth.SignatureBlacklist')}" />
-
- <bean id="shibboleth.BasicClientTLSValidationConfiguration" abstract="true"
- class="org.opensaml.security.x509.tls.impl.BasicClientTLSValidationConfiguration" />
-
- <bean id="shibboleth.BasicHttpClientSecurityConfiguration" abstract="true"
- class="org.opensaml.security.httpclient.impl.BasicHttpClientSecurityConfiguration" />
+ <!-- This is a stub pending the eventual requirement to update web.xml -->
- <bean id="shibboleth.BasicSignatureSigningConfiguration" abstract="true"
- class="org.opensaml.xmlsec.impl.BasicSignatureSigningConfiguration"
- p:includedAlgorithms="#{getObject('shibboleth.IncludedSignatureAlgorithms') ?: getObject('shibboleth.SignatureWhitelist')}"
- p:excludedAlgorithms="#{getObject('shibboleth.ExcludedSignatureAlgorithms') ?: getObject('shibboleth.SignatureBlacklist')}" />
-
- <bean id="shibboleth.BasicEncryptionConfiguration" abstract="true"
- class="org.opensaml.xmlsec.impl.BasicEncryptionConfiguration"
- p:includedAlgorithms="#{getObject('shibboleth.IncludedEncryptionAlgorithms') ?: getObject('shibboleth.EncryptionWhitelist')}"
- p:excludedAlgorithms="#{getObject('shibboleth.ExcludedEncryptionAlgorithms') ?: getObject('shibboleth.EncryptionBlacklist')}" />
-
- <bean id="shibboleth.BasicDecryptionConfiguration" abstract="true"
- class="org.opensaml.xmlsec.impl.BasicDecryptionConfiguration"
- p:includedAlgorithms="#{getObject('shibboleth.IncludedEncryptionAlgorithms') ?: getObject('shibboleth.EncryptionWhitelist')}"
- p:excludedAlgorithms="#{getObject('shibboleth.ExcludedEncryptionAlgorithms') ?: getObject('shibboleth.EncryptionBlacklist')}" />
-
- <!-- Beans that implement the mashing of security configurations into final parameter sets. -->
-
- <bean id="shibboleth.SignatureValidationParametersResolver"
- class="org.opensaml.xmlsec.impl.BasicSignatureValidationParametersResolver" />
- <bean id="shibboleth.SignatureSigningParametersResolver"
- class="org.opensaml.saml.security.impl.SAMLMetadataSignatureSigningParametersResolver" />
- <bean id="shibboleth.DecryptionParametersResolver"
- class="org.opensaml.xmlsec.impl.BasicDecryptionParametersResolver" />
- <bean id="shibboleth.EncryptionParametersResolver"
- class="org.opensaml.saml.security.impl.SAMLMetadataEncryptionParametersResolver"
- c:resolver-ref="shibboleth.MetadataCredentialResolver" />
- <bean id="shibboleth.ClientTLSValidationParametersResolver"
- class="org.opensaml.security.x509.tls.impl.BasicClientTLSValidationParametersResolver" />
- <bean id="shibboleth.HttpClientSecurityParametersResolver"
- class="org.opensaml.security.httpclient.impl.BasicHttpClientSecurityParametersResolver" />
-
- <!--
- The beans below are primarily used by trust engines in relying-party-system.xml, but also in the
- resolver for encryption parameters above.
- -->
-
- <bean id="shibboleth.MetadataCredentialResolver"
- class="org.opensaml.saml.security.impl.MetadataCredentialResolver"
- p:roleDescriptorResolver-ref="shibboleth.RoleDescriptorResolver"
- p:keyInfoCredentialResolver-ref="shibboleth.KeyInfoCredentialResolver">
- </bean>
-
- <bean id="shibboleth.KeyInfoCredentialResolver"
- class="org.opensaml.xmlsec.config.impl.DefaultSecurityConfigurationBootstrap"
- factory-method="buildBasicInlineKeyInfoCredentialResolver" />
-
- <!-- These are deprecated because using them triggers Spring bugs when contexts reload. -->
-
- <bean id="shibboleth.NonCachingHttpClient"
- lazy-init="true"
- class="net.shibboleth.idp.profile.spring.relyingparty.metadata.impl.HttpClientFactoryBean"
- p:tLSSocketFactory="#{ %{idp.httpclient.useTrustEngineTLSSocketFactory:false} or %{idp.httpclient.useSecurityEnhancedTLSSocketFactory:false} ? @'shibboleth.SecurityEnhancedTLSSocketFactory' : null }"
- p:connectionDisregardTLSCertificate="%{idp.httpclient.connectionDisregardTLSCertificate:false}"
- p:connectionTimeout="%{idp.httpclient.connectionTimeout:PT1M}"
- p:connectionRequestTimeout="%{idp.httpclient.connectionRequestTimeout:PT1M}"
- p:socketTimeout="%{idp.httpclient.socketTimeout:PT1M}"
- p:maxConnectionsTotal="%{idp.httpclient.maxConnectionsTotal:100}"
- p:maxConnectionsPerRoute="%{idp.httpclient.maxConnectionsPerRoute:100}" />
-
- <bean id="shibboleth.FileCachingHttpClient"
- lazy-init="true"
- class="net.shibboleth.idp.profile.spring.relyingparty.metadata.impl.FileCachingHttpClientFactoryBean"
- p:tLSSocketFactory="#{ %{idp.httpclient.useTrustEngineTLSSocketFactory:false} or %{idp.httpclient.useSecurityEnhancedTLSSocketFactory:false} ? @'shibboleth.SecurityEnhancedTLSSocketFactory' : null }"
- p:connectionDisregardTLSCertificate="%{idp.httpclient.connectionDisregardTLSCertificate:false}"
- p:connectionTimeout="%{idp.httpclient.connectionTimeout:PT1M}"
- p:connectionRequestTimeout="%{idp.httpclient.connectionRequestTimeout:PT1M}"
- p:socketTimeout="%{idp.httpclient.socketTimeout:PT1M}"
- p:maxConnectionsTotal="%{idp.httpclient.maxConnectionsTotal:100}"
- p:maxConnectionsPerRoute="%{idp.httpclient.maxConnectionsPerRoute:100}"
- p:cacheDirectory="%{idp.httpclient.filecaching.cacheDirectory}"
- p:maxCacheEntries="%{idp.httpclient.filecaching.maxCacheEntries:100}"
- p:maxCacheEntrySize="%{idp.httpclient.filecaching.maxCacheEntrySize:10485760}" />
-
- <bean id="shibboleth.MemoryCachingHttpClient"
- lazy-init="true"
- class="net.shibboleth.idp.profile.spring.relyingparty.metadata.impl.InMemoryCachingHttpClientFactoryBean"
- p:tLSSocketFactory="#{ %{idp.httpclient.useTrustEngineTLSSocketFactory:false} or %{idp.httpclient.useSecurityEnhancedTLSSocketFactory:false} ? @'shibboleth.SecurityEnhancedTLSSocketFactory' : null }"
- p:connectionDisregardTLSCertificate="%{idp.httpclient.connectionDisregardTLSCertificate:false}"
- p:connectionTimeout="%{idp.httpclient.connectionTimeout:PT1M}"
- p:connectionRequestTimeout="%{idp.httpclient.connectionRequestTimeout:PT1M}"
- p:socketTimeout="%{idp.httpclient.socketTimeout:PT1M}"
- p:maxConnectionsTotal="%{idp.httpclient.maxConnectionsTotal:100}"
- p:maxConnectionsPerRoute="%{idp.httpclient.maxConnectionsPerRoute:100}"
- p:maxCacheEntries="%{idp.httpclient.memorycaching.maxCacheEntries:50}"
- p:maxCacheEntrySize="%{idp.httpclient.memorycaching.maxCacheEntrySize:1048576}" />
-
- <!-- Back to non-deprecated beans. -->
-
- <!--
- This is a default client for embedded system use but should NOT be used by deployers OR
- within the IdP within any reloadable service child contexts.
- -->
-
- <bean id="shibboleth.InternalHttpClient" parent="shibboleth.HttpClientFactory" lazy-init="true"
- p:tLSSocketFactory="#{ %{idp.httpclient.useTrustEngineTLSSocketFactory:false} or %{idp.httpclient.useSecurityEnhancedTLSSocketFactory:false} ? @'shibboleth.SecurityEnhancedTLSSocketFactory' : null }"
- p:connectionDisregardTLSCertificate="%{idp.httpclient.connectionDisregardTLSCertificate:false}"
- p:connectionTimeout="%{idp.httpclient.connectionTimeout:PT1M}"
- p:connectionRequestTimeout="%{idp.httpclient.connectionRequestTimeout:PT1M}"
- p:socketTimeout="%{idp.httpclient.socketTimeout:PT1M}"
- p:maxConnectionsTotal="%{idp.httpclient.maxConnectionsTotal:100}"
- p:maxConnectionsPerRoute="%{idp.httpclient.maxConnectionsPerRoute:100}" />
-
- <bean id="shibboleth.SecurityEnhancedTLSSocketFactory" name="shibboleth.TrustEngineTLSSocketFactory"
- lazy-init="true"
- class="org.opensaml.security.httpclient.impl.SecurityEnhancedHttpClientSupport"
- factory-method="buildTLSSocketFactory" />
-
- <bean id="shibboleth.SecurityEnhancedTLSSocketFactoryWithClientTLS"
- lazy-init="true"
- class="org.opensaml.security.httpclient.impl.SecurityEnhancedHttpClientSupport"
- factory-method="buildTLSSocketFactoryWithClientTLS" />
-
- <bean id="shibboleth.SecurityEnhancedTLSSocketFactoryWithClientTLSOnly"
- lazy-init="true"
- class="org.opensaml.security.httpclient.impl.SecurityEnhancedHttpClientSupport"
- factory-method="buildTLSSocketFactoryWithClientTLSOnly" />
-
- <bean id="shibboleth.StaticExplicitTrustEngine" abstract="true"
- class="net.shibboleth.idp.profile.spring.factory.StaticExplicitKeyFactoryBean" />
-
- <bean id="shibboleth.StaticPKIXTrustEngine" abstract="true"
- class="net.shibboleth.idp.profile.spring.factory.StaticPKIXFactoryBean" />
-
- <bean id="shibboleth.HTTPResource" abstract="true"
- class="net.shibboleth.idp.profile.spring.resource.impl.HTTPResourceFactoryBean" />
-
- <bean id="shibboleth.X509TrustManager" abstract="true"
- class="org.opensaml.security.trust.impl.TrustEngineX509TrustManager" />
-
- <!-- Default Jackson ObjectMapper. -->
-
- <bean id="shibboleth.JSONObjectMapper" class="com.fasterxml.jackson.databind.ObjectMapper" />
-
- <bean class="org.springframework.beans.factory.config.MethodInvokingBean"
- p:targetObject-ref="shibboleth.JSONObjectMapper"
- p:targetMethod="setSerializationInclusion">
- <property name="arguments">
- <util:constant static-field="com.fasterxml.jackson.annotation.JsonInclude.Include.NON_NULL" />
- </property>
- </bean>
-
- <bean class="org.springframework.beans.factory.config.MethodInvokingBean"
- p:targetObject-ref="shibboleth.JSONObjectMapper"
- p:targetMethod="registerModule">
- <property name="arguments">
- <bean class="com.fasterxml.jackson.datatype.jsr310.JavaTimeModule" />
- </property>
- </bean>
-
- <bean class="org.springframework.beans.factory.config.MethodInvokingBean"
- p:targetObject-ref="shibboleth.JSONObjectMapper"
- p:targetMethod="setDateFormat">
- <property name="arguments">
- <bean class="java.text.SimpleDateFormat" c:_0="YYYY-MM-dd'T'HH:mm:ss.SSSZZ" />
- </property>
- </bean>
-
- <!-- Action bean templates. -->
-
- <bean id="shibboleth.AuditFormattingMapParser"
- class="net.shibboleth.idp.profile.audit.impl.PopulateAuditContext.FormattingMapParser"
- c:_0-ref="shibboleth.AuditFormattingMap" />
-
- <bean id="shibboleth.AbstractPopulateAuditContext" abstract="true"
- class="net.shibboleth.idp.profile.audit.impl.PopulateAuditContext" scope="prototype"
- p:formattingMapParser-ref="shibboleth.AuditFormattingMapParser"
- p:dateTimeFormat="#{getObject('shibboleth.AuditDateTimeFormat')}"
- p:useDefaultTimeZone="#{getObject('shibboleth.AuditDefaultTimeZone') ?: false}"
- p:fieldReplacements="#{getObject('shibboleth.AuditFieldReplacementMap')}" />
-
- <!-- Default attribute mapping support for new registry service, exposed here for extension use. -->
-
- <bean id="shibboleth.DefaultNamingRegistry"
- class="org.springframework.beans.factory.config.MapFactoryBean">
- <property name="sourceMap">
- <map>
- <entry key="#{T(org.opensaml.saml.saml2.core.Attribute)}">
- <bean class="net.shibboleth.idp.saml.attribute.transcoding.AbstractSAML2AttributeTranscoder.NamingFunction" />
- </entry>
- <entry key="#{T(org.opensaml.saml.saml1.core.AttributeDesignator)}">
- <bean class="net.shibboleth.idp.saml.attribute.transcoding.AbstractSAML1AttributeTranscoder.NamingFunction" />
- </entry>
- <entry key="#{T(net.shibboleth.idp.cas.attribute.Attribute)}">
- <bean class="net.shibboleth.idp.cas.attribute.AbstractCASAttributeTranscoder.NamingFunction" />
- </entry>
- </map>
- </property>
- </bean>
-
- <!-- Beans for user-visible metadata configuration usage -->
-
- <!-- Secondary indexing support -->
-
- <bean id="shibboleth.Metadata.Index.SAMLArtifact" class="org.opensaml.saml.metadata.resolver.index.impl.SAMLArtifactMetadataIndex" />
-
- <!-- Note: By default this indexes all endpoints under all roles.
- To index more selectively by role and endpoint name/type, use the predicate below. -->
- <bean id="shibboleth.Metadata.Index.Endpoint" class="org.opensaml.saml.metadata.resolver.index.impl.EndpointMetadataIndex" />
-
- <!-- By default this predicate selects no endpoints to index.
- So this would typically be used only as a parent bean, with an added ctor param.
- This would be a Map<QName, Set<QName>> (RoleDescriptor element/type -> Endpoint(s) element/type),
- either as a single ctor param or as a named ctor param c:indexableTypes. -->
- <bean id="shibboleth.Metadata.Index.Endpoint.Predicate.ByRoleAndEndpoint"
- class="org.opensaml.saml.metadata.resolver.index.impl.EndpointMetadataIndex.DefaultEndpointSelectionPredicate" />
-
-
- <!-- Metadata Query Protocol (MDQ) support -->
-
- <bean id="shibboleth.Metadata.MDQ.URLBuilder.SAMLArtifact" class="org.opensaml.saml.metadata.resolver.impl.SAMLArtifactURLBuilder" />
-
+ <import resource="classpath:/net/shibboleth/idp/conf/global-system.xml" />
</beans>
diff --git a/idp-core/src/main/java/net/shibboleth/idp/spring/IdPPropertiesApplicationContextInitializer.java b/idp-core/src/main/java/net/shibboleth/idp/spring/IdPPropertiesApplicationContextInitializer.java
index b0f06120d..3d21a4100 100644
--- a/idp-core/src/main/java/net/shibboleth/idp/spring/IdPPropertiesApplicationContextInitializer.java
+++ b/idp-core/src/main/java/net/shibboleth/idp/spring/IdPPropertiesApplicationContextInitializer.java
@@ -80,6 +80,13 @@ public class IdPPropertiesApplicationContextInitializer
@Override public void initialize(@Nonnull final ConfigurableApplicationContext applicationContext) {
log.debug("Initializing application context '{}'", applicationContext);
+ // TODO: Override default property replacement syntax.
+ // We can't do this now because it would break web.xml's use of ${idp.home}
+ // If we end up breaking web.xml later, I think we could force that in line.
+ // See IDP-1642
+ // applicationContext.getEnvironment().setPlaceholderPrefix("%{");
+ // applicationContext.getEnvironment().setPlaceholderSuffix("}");
+
final String searchLocation = selectSearchLocation(applicationContext);
log.debug("Attempting to find '{}' at search location '{}'", getSearchTarget(), searchLocation);
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list