[java-identity-provider] 02/02: IDP-1595 Plugin Handling improvements
Rod Widdowson
rdw at steadingsoftware.com
Wed Sep 30 16:09:32 UTC 2020
This is an automated email from the git hooks/post-receive script.
rdw pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=806f97f42caf0e4c43136849bf4deeb590d7894b
commit 806f97f42caf0e4c43136849bf4deeb590d7894b
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Wed Sep 30 17:08:51 2020 +0100
IDP-1595 Plugin Handling improvements
https://issues.shibboleth.net/jira/browse/IDP-1595
--truststore for the location of the truststore (may be outside
idp.home, but has to exist).
---
.../idp/installer/plugin/impl/PluginInstaller.java | 19 ++++--
.../plugin/impl/PluginInstallerArguments.java | 13 ++++
.../installer/plugin/impl/PluginInstallerCLI.java | 1 +
.../idp/installer/plugin/impl/TrustStore.java | 74 +++++++++++++++-------
.../idp/installer/plugin/impl/TrustStoreTest.java | 6 ++
5 files changed, 86 insertions(+), 27 deletions(-)
diff --git a/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/PluginInstaller.java b/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/PluginInstaller.java
index e0b6fb42f..814793e54 100644
--- a/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/PluginInstaller.java
+++ b/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/PluginInstaller.java
@@ -109,14 +109,17 @@ public final class PluginInstaller extends AbstractInitializableComponent implem
/** The callback before we download a file. */
@Nonnull private Predicate<String> acceptDownload = Predicates.alwaysFalse();
-
+
/** The actual distribution. */
private Path distribution;
+
+ /** Where to get the keys from if not defaulted. */
+ private String truststore;
/** What to use to download things. */
private HttpClient httpClient;
- /** set IdP Home.
+ /** Set IdP Home.
* @param home Where we are working from
*/
public void setIdpHome(@Nonnull final Path home) {
@@ -124,13 +127,20 @@ public final class PluginInstaller extends AbstractInitializableComponent implem
idpHome = Constraint.isNotNull(home, "IdPHome should be non-null");
}
- /** Set the plugin in.
- * @param id The pluginId to set.
+ /** Set the plugin id.
+ * @param id what to set.
*/
public void setPluginId(@Nonnull @NotEmpty final String id) {
pluginId = Constraint.isNotNull(StringSupport.trimOrNull(id), "Plugin id should be be non-null");
}
+ /** Set the truststore.
+ * @param loc what set.
+ */
+ public void setTrustore(@Nullable final String loc) {
+ truststore = StringSupport.trimOrNull(loc);
+ }
+
/** Set the acceptCert predicate.
* @param what what to set.
*/
@@ -586,6 +596,7 @@ public final class PluginInstaller extends AbstractInitializableComponent implem
new FileInputStream(base.resolve(fileName + ".asc").toFile()))) {
final TrustStore trust = new TrustStore();
trust.setIdpHome(idpHome);
+ trust.setTrustStore(truststore);
trust.setPluginId(pluginId);
trust.initialize();
final Signature sig = TrustStore.signatureOf(sigStream);
diff --git a/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/PluginInstallerArguments.java b/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/PluginInstallerArguments.java
index a8744a631..fe98a0fa8 100644
--- a/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/PluginInstallerArguments.java
+++ b/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/PluginInstallerArguments.java
@@ -63,6 +63,10 @@ public class PluginInstallerArguments extends AbstractIdPHomeAwareCommandLineArg
@Parameter(names= {"-i", "--input"})
@Nullable private String input;
+ /** Truststore to use for sining. */
+ @Parameter(names= {"--truststore"})
+ @Nullable private String truststore;
+
/** Update plugin Id. */
@Parameter(names= {"-u", "--update"})
@Nullable private String updatePluginId;
@@ -121,6 +125,13 @@ public class PluginInstallerArguments extends AbstractIdPHomeAwareCommandLineArg
return pluginId;
}
+ /** get TrustStore (if specified).
+ * @return {@link #truststore}
+ */
+ @Nullable public String getTruststore() {
+ return truststore;
+ }
+
/** Get the digested parent URL.
* @return Returns the digested parent URL.
*
@@ -296,6 +307,8 @@ public class PluginInstallerArguments extends AbstractIdPHomeAwareCommandLineArg
"remove any installed jars (and other resources) from the war file. \n" +
"\t\t\tDOES NOT UNDO any other installation"));
out.println(String.format(" %-22s %s", "--noPrompt", "Unattended Install"));
+ out.println(String.format(" %-22s %s", "--truststore <path>",
+ "Explicit location to look for keys (should exist but may be empty"));
out.println();
}
diff --git a/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/PluginInstallerCLI.java b/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/PluginInstallerCLI.java
index 7c4f8d634..a3f32a7e3 100644
--- a/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/PluginInstallerCLI.java
+++ b/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/PluginInstallerCLI.java
@@ -168,6 +168,7 @@ public final class PluginInstallerCLI extends AbstractIdPHomeAwareCommandLine<Pl
inst.setAcceptCert(new InstallerQuery("Accept this Certificate"));
inst.setAcceptDownload(new InstallerQuery("Download from"));
}
+ inst.setTrustore(args.getTruststore());
if (getHttpClient()!= null) {
inst.setHttpClient(getHttpClient());
}
diff --git a/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/TrustStore.java b/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/TrustStore.java
index 1d63b0b85..612fed327 100644
--- a/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/TrustStore.java
+++ b/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/TrustStore.java
@@ -29,6 +29,7 @@ import java.util.Iterator;
import java.util.function.Predicate;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import javax.annotation.concurrent.NotThreadSafe;
import org.bouncycastle.bcpg.ArmoredOutputStream;
@@ -64,6 +65,9 @@ import net.shibboleth.utilities.java.support.component.ComponentSupport;
/** Where the IdP is installed. */
@NonnullAfterInit private Path idpHome;
+ /** Explicit path to trust store. */
+ @NonnullAfterInit private String explicitTrustStore;
+
/** The plugin this is the trust store for. */
@NonnullAfterInit private String pluginId;
@@ -94,6 +98,14 @@ import net.shibboleth.utilities.java.support.component.ComponentSupport;
idpHome = what;
}
+ /** Set explicitTrustStore.
+ * @param what The value to set.
+ */
+ public void setTrustStore(@Nullable final String what) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+ explicitTrustStore = what;
+ }
+
/** Return a store loaded from the supplied stream.
*
* @param in the stream
@@ -294,36 +306,52 @@ import net.shibboleth.utilities.java.support.component.ComponentSupport;
/** {@inheritDoc} */
protected void doInitialize() throws ComponentInitializationException {
super.doInitialize();
-
- if (idpHome == null) {
- throw new ComponentInitializationException("IdP home not set up");
- }
-
+
if (pluginId == null) {
throw new ComponentInitializationException("Plugin Id not set up");
}
-
- if (!Files.exists(idpHome)) {
- throw new ComponentInitializationException("IdP home '" + idpHome + "' does not exist");
- }
- try {
- final Path parent = idpHome.resolve("credentials").resolve(pluginId);
- if (!Files.exists(parent)) {
- log.info("Plugin {}: Trust store folder does not exist, creating", pluginId);
- Files.createDirectories(parent);
- }
- store = parent.resolve("truststore.asc");
- backup = parent.resolve("truststore.asc.backup");
+ if (explicitTrustStore != null) {
+ store = Path.of(explicitTrustStore);
if (!Files.exists(store)) {
- log.info("Plugin {}: Trust store does not exist, creating", pluginId);
- createNewStore();
- } else {
- log.debug("Plugin {}: Trust store exists, loading", pluginId);
+ log.error("Trust store {} does not exist", explicitTrustStore);
+ throw new ComponentInitializationException("Supplied trust store does not exist.");
+ }
+ backup = Path.of(explicitTrustStore + ".backup");
+ log.debug("Plugin {}: Loading explicit truststore {}", pluginId, explicitTrustStore);
+ try {
loadStore();
+ } catch (final IOException e) {
+ log.error("Plugin {}: Could not load explicit trust store {}", pluginId, explicitTrustStore, e);
+ throw new ComponentInitializationException(e);
+ }
+ } else {
+ if (idpHome == null) {
+ throw new ComponentInitializationException("IdP home not set up");
+ }
+
+ if (!Files.exists(idpHome)) {
+ throw new ComponentInitializationException("IdP home '" + idpHome + "' does not exist");
+ }
+
+ try {
+ final Path parent = idpHome.resolve("credentials").resolve(pluginId);
+ if (!Files.exists(parent)) {
+ log.info("Plugin {}: Trust store folder does not exist, creating", pluginId);
+ Files.createDirectories(parent);
+ }
+ store = parent.resolve("truststore.asc");
+ backup = parent.resolve("truststore.asc.backup");
+ if (!Files.exists(store)) {
+ log.info("Plugin {}: Trust store does not exist, creating", pluginId);
+ createNewStore();
+ } else {
+ log.debug("Plugin {}: Trust store exists, loading", pluginId);
+ loadStore();
+ }
+ } catch (final IOException e) {
+ throw new ComponentInitializationException(e);
}
- } catch (final IOException e) {
- throw new ComponentInitializationException(e);
}
}
diff --git a/idp-installer/src/test/java/net/shibboleth/idp/installer/plugin/impl/TrustStoreTest.java b/idp-installer/src/test/java/net/shibboleth/idp/installer/plugin/impl/TrustStoreTest.java
index 3cc021c31..bc81864d3 100644
--- a/idp-installer/src/test/java/net/shibboleth/idp/installer/plugin/impl/TrustStoreTest.java
+++ b/idp-installer/src/test/java/net/shibboleth/idp/installer/plugin/impl/TrustStoreTest.java
@@ -142,5 +142,11 @@ public class TrustStoreTest {
ts.setPluginId(pluginId);
ts.initialize();
assertTrue(ts.contains(signature));
+
+ ts = new TrustStore();
+ ts.setIdpHome(dir);
+ ts.setTrustStore(dir.resolve("credentials").resolve(pluginId).resolve("truststore.asc").toString());
+ ts.setPluginId(pluginId);
+ ts.initialize();
}
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list