[java-identity-provider] branch master updated: IDP-1619 - Deprecate terms from classes and configuration
Scott Cantor
cantor.2 at osu.edu
Wed Jun 10 18:00:52 UTC 2020
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=c1a21cdae073f6624189fdd145cfcfaab110af7b
The following commit(s) were added to refs/heads/master by this push:
new c1a21cdae IDP-1619 - Deprecate terms from classes and configuration
c1a21cdae is described below
commit c1a21cdae073f6624189fdd145cfcfaab110af7b
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Jun 10 14:00:49 2020 -0400
IDP-1619 - Deprecate terms from classes and configuration
https://issues.shibboleth.net/jira/browse/IDP-1619
Rename algorithm policy beans in global.xml
---
idp-conf/src/main/resources/conf/global.xml | 22 ++++++++--------
.../main/resources/system/conf/global-system.xml | 29 +++++++++++++++-------
idp-conf/src/test/resources/conf/global.xml | 22 ++++++++--------
3 files changed, 42 insertions(+), 31 deletions(-)
diff --git a/idp-conf/src/main/resources/conf/global.xml b/idp-conf/src/main/resources/conf/global.xml
index 457a814d0..c485f3f65 100644
--- a/idp-conf/src/main/resources/conf/global.xml
+++ b/idp-conf/src/main/resources/conf/global.xml
@@ -15,23 +15,23 @@
<!-- Use this file to define any custom beans needed globally. -->
<!--
- Algorithm whitelists and blacklists that override or merge with library defaults. Normally you can leave
- these empty or commented and use the system defaults, but you can override those defaults using these lists.
- Each <value> element is an algorithm URI, or you can use <util:constant> elements in place of literal values.
+ Algorithm include/exclude sets that override or merge with library defaults. Normally you can leave these
+ empty or commented and use the system defaults, but you can override those defaults using these beans.
+ Each <value> element is an algorithm URI; you can also use <util:constant> elements in place of literal values.
-->
<!--
- <util:list id="shibboleth.SignatureWhitelist">
- </util:list>
+ <util:set id="shibboleth.IncludedSignatureAlgorithms">
+ </util:set>
- <util:list id="shibboleth.SignatureBlacklist">
- </util:list>
+ <util:set id="shibboleth.ExcludedSignatureAlgorithms">
+ </util:set>
- <util:list id="shibboleth.EncryptionWhitelist">
- </util:list>
+ <util:set id="shibboleth.IncludedEncryptionAlgorithms">
+ </util:set>
- <util:list id="shibboleth.EncryptionBlacklist">
- </util:list>
+ <util:set id="shibboleth.ExcludedEncryptionAlgorithms">
+ </util:set>
-->
<!--
diff --git a/idp-conf/src/main/resources/system/conf/global-system.xml b/idp-conf/src/main/resources/system/conf/global-system.xml
index a8d028e95..c0119121c 100644
--- a/idp-conf/src/main/resources/system/conf/global-system.xml
+++ b/idp-conf/src/main/resources/system/conf/global-system.xml
@@ -276,11 +276,22 @@
</bean>
<!-- Parent beans for Signature/Encryption/TLS/HttpClientSecurity Configuration objects. -->
-
+
+ <bean class="net.shibboleth.ext.spring.util.DeprecatedBeanDetector" c:_1="global.xml">
+ <constructor-arg index="0">
+ <map>
+ <entry key="shibboleth.SignatureWhitelist" value="shibboleth.IncludedSignatureAlgorithms" />
+ <entry key="shibboleth.SignatureBlacklist" value="shibboleth.ExcludedSignatureAlgorithms" />
+ <entry key="shibboleth.EncryptionWhitelist" value="shibboleth.IncludedEncryptionAlgorithms" />
+ <entry key="shibboleth.EncryptionBlacklist" value="shibboleth.ExcludedEncryptionAlgorithms" />
+ </map>
+ </constructor-arg>
+ </bean>
+
<bean id="shibboleth.BasicSignatureValidationConfiguration" abstract="true"
class="org.opensaml.xmlsec.impl.BasicSignatureValidationConfiguration"
- p:whitelistedAlgorithms="#{getObject('shibboleth.SignatureWhitelist')}"
- p:blacklistedAlgorithms="#{getObject('shibboleth.SignatureBlacklist')}" />
+ p:whitelistedAlgorithms="#{getObject('shibboleth.IncludedSignatureAlgorithms') ?: getObject('shibboleth.SignatureWhitelist')}"
+ p:blacklistedAlgorithms="#{getObject('shibboleth.ExcludedSignatureAlgorithms') ?: getObject('shibboleth.SignatureBlacklist')}" />
<bean id="shibboleth.BasicClientTLSValidationConfiguration" abstract="true"
class="org.opensaml.security.x509.tls.impl.BasicClientTLSValidationConfiguration" />
@@ -290,18 +301,18 @@
<bean id="shibboleth.BasicSignatureSigningConfiguration" abstract="true"
class="org.opensaml.xmlsec.impl.BasicSignatureSigningConfiguration"
- p:whitelistedAlgorithms="#{getObject('shibboleth.SignatureWhitelist')}"
- p:blacklistedAlgorithms="#{getObject('shibboleth.SignatureBlacklist')}" />
+ p:whitelistedAlgorithms="#{getObject('shibboleth.IncludedSignatureAlgorithms') ?: getObject('shibboleth.SignatureWhitelist')}"
+ p:blacklistedAlgorithms="#{getObject('shibboleth.ExcludedSignatureAlgorithms') ?: getObject('shibboleth.SignatureBlacklist')}" />
<bean id="shibboleth.BasicEncryptionConfiguration" abstract="true"
class="org.opensaml.xmlsec.impl.BasicEncryptionConfiguration"
- p:whitelistedAlgorithms="#{getObject('shibboleth.EncryptionWhitelist')}"
- p:blacklistedAlgorithms="#{getObject('shibboleth.EncryptionBlacklist')}" />
+ p:whitelistedAlgorithms="#{getObject('shibboleth.IncludedEncryptionAlgorithms') ?: getObject('shibboleth.EncryptionWhitelist')}"
+ p:blacklistedAlgorithms="#{getObject('shibboleth.ExcludedEncryptionAlgorithms') ?: getObject('shibboleth.EncryptionBlacklist')}" />
<bean id="shibboleth.BasicDecryptionConfiguration" abstract="true"
class="org.opensaml.xmlsec.impl.BasicDecryptionConfiguration"
- p:whitelistedAlgorithms="#{getObject('shibboleth.EncryptionWhitelist')}"
- p:blacklistedAlgorithms="#{getObject('shibboleth.EncryptionBlacklist')}" />
+ p:whitelistedAlgorithms="#{getObject('shibboleth.IncludedEncryptionAlgorithms') ?: getObject('shibboleth.EncryptionWhitelist')}"
+ p:blacklistedAlgorithms="#{getObject('shibboleth.ExcludedEncryptionAlgorithms') ?: getObject('shibboleth.EncryptionBlacklist')}" />
<!-- Beans that implement the mashing of security configurations into final parameter sets. -->
diff --git a/idp-conf/src/test/resources/conf/global.xml b/idp-conf/src/test/resources/conf/global.xml
index 7b79f7afb..4c2b8a9cf 100644
--- a/idp-conf/src/test/resources/conf/global.xml
+++ b/idp-conf/src/test/resources/conf/global.xml
@@ -17,23 +17,23 @@
<!-- Use this file to define any custom beans needed globally. -->
<!--
- Algorithm whitelists and blacklists that override or merge with library defaults. Normally you can leave
- these empty or commented and use the system defaults, but you can override those defaults using these lists.
- Each <value> element is an algorithm URI, or you can use <util:constant> elements in place of literal values.
+ Algorithm include/exclude sets that override or merge with library defaults. Normally you can leave these
+ empty or commented and use the system defaults, but you can override those defaults using these beans.
+ Each <value> element is an algorithm URI; you can also use <util:constant> elements in place of literal values.
-->
<!--
- <util:list id="shibboleth.SignatureWhitelist">
- </util:list>
+ <util:set id="shibboleth.IncludedSignatureAlgorithms">
+ </util:set>
- <util:list id="shibboleth.SignatureBlacklist">
- </util:list>
+ <util:set id="shibboleth.ExcludedSignatureAlgorithms">
+ </util:set>
- <util:list id="shibboleth.EncryptionWhitelist">
- </util:list>
+ <util:set id="shibboleth.IncludedEncryptionAlgorithms">
+ </util:set>
- <util:list id="shibboleth.EncryptionBlacklist">
- </util:list>
+ <util:set id="shibboleth.ExcludedEncryptionAlgorithms">
+ </util:set>
-->
<!--
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list