[java-identity-provider] branch main updated: IDP-1884 - Need a way to auto-inject creds into DefaultRelyingPartyConfigurationResolver
Scott Cantor
cantor.2 at osu.edu
Wed Dec 1 18:33:36 UTC 2021
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=e7501b8da30f5437863af2eba383705bcb6d7117
The following commit(s) were added to refs/heads/main by this push:
new e7501b8da IDP-1884 - Need a way to auto-inject creds into DefaultRelyingPartyConfigurationResolver
e7501b8da is described below
commit e7501b8da30f5437863af2eba383705bcb6d7117
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Dec 1 13:33:32 2021 -0500
IDP-1884 - Need a way to auto-inject creds into
DefaultRelyingPartyConfigurationResolver
https://shibboleth.atlassian.net/browse/IDP-1884
---
.../shibboleth/idp/conf/relying-party-system.xml | 19 ++++++-
.../RelyingPartyResolverCredentialHolder.java | 65 ++++++++++++++++++++++
.../DefaultRelyingPartyConfigurationResolver.java | 28 ++++++++--
3 files changed, 104 insertions(+), 8 deletions(-)
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-system.xml
index 230397741..ff51df832 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-system.xml
@@ -12,6 +12,8 @@
default-init-method="initialize"
default-destroy-method="destroy">
+ <context:annotation-config/>
+
<!-- This is one of the few properties we rely on that has no default. -->
<bean id="entityID" class="java.lang.String" c:_0="%{idp.entityID}" />
@@ -20,9 +22,20 @@
p:unverifiedConfiguration-ref="shibboleth.UnverifiedRelyingParty"
p:defaultConfiguration-ref="shibboleth.DefaultRelyingParty"
p:relyingPartyConfigurations-ref="shibboleth.RelyingPartyOverrides"
- p:defaultSecurityConfiguration-ref="%{idp.security.config:shibboleth.DefaultSecurityConfiguration}"
- p:signingCredentials="#{getObject('shibboleth.SigningCredentials')}"
- p:encryptionCredentials="#{getObject('shibboleth.EncryptionCredentials')}" />
+ p:defaultSecurityConfiguration-ref="%{idp.security.config:shibboleth.DefaultSecurityConfiguration}" />
+
+ <!--
+ Auto-wiring exposers for credentials to get them loaded into the bean above.
+ The qualifiers control which auto-wiring point is used.
+ -->
+ <bean class="net.shibboleth.idp.relyingparty.RelyingPartyResolverCredentialHolder"
+ c:_0="#{getObject('shibboleth.SigningCredentials')}">
+ <qualifier value="signing"/>
+ </bean>
+ <bean class="net.shibboleth.idp.relyingparty.RelyingPartyResolverCredentialHolder"
+ c:_0="#{getObject('shibboleth.EncryptionCredentials')}">
+ <qualifier value="encryption"/>
+ </bean>
<!-- Parent bean for generic RelyingParty overrides that establishes defaults. -->
<bean id="RelyingParty" abstract="true" class="net.shibboleth.idp.relyingparty.RelyingPartyConfiguration"
diff --git a/idp-profile-api/src/main/java/net/shibboleth/idp/relyingparty/RelyingPartyResolverCredentialHolder.java b/idp-profile-api/src/main/java/net/shibboleth/idp/relyingparty/RelyingPartyResolverCredentialHolder.java
new file mode 100644
index 000000000..4fddd9e0d
--- /dev/null
+++ b/idp-profile-api/src/main/java/net/shibboleth/idp/relyingparty/RelyingPartyResolverCredentialHolder.java
@@ -0,0 +1,65 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.relyingparty;
+
+import java.util.Collection;
+import java.util.Collections;
+import java.util.List;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.security.credential.Credential;
+
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
+
+/**
+ * This is a utility class used as an auto-wiring source for collections of
+ * signing and encryption {@link Credential} objects so that other layers of the
+ * system can gain access to the complete set of them.
+ *
+ * @since 4.2.0
+ */
+public class RelyingPartyResolverCredentialHolder {
+
+ /** Credentials to expose. */
+ @Nonnull @NonnullElements private final List<Credential> credentials;
+
+ /**
+ * Constructor.
+ *
+ * @param creds credentials to expose to other components
+ */
+ public RelyingPartyResolverCredentialHolder(@Nullable @NonnullElements final Collection<Credential> creds) {
+ if (creds != null) {
+ credentials = List.copyOf(creds);
+ } else {
+ credentials = Collections.emptyList();
+ }
+ }
+
+ /**
+ * Get the credentials to expose to other components.
+ *
+ * @return credentials to expose
+ */
+ @Nonnull @NonnullElements public Collection<Credential> getCredentials() {
+ return credentials;
+ }
+
+}
\ No newline at end of file
diff --git a/idp-profile-impl/src/main/java/net/shibboleth/idp/relyingparty/impl/DefaultRelyingPartyConfigurationResolver.java b/idp-profile-impl/src/main/java/net/shibboleth/idp/relyingparty/impl/DefaultRelyingPartyConfigurationResolver.java
index 9cd338419..956846a4a 100644
--- a/idp-profile-impl/src/main/java/net/shibboleth/idp/relyingparty/impl/DefaultRelyingPartyConfigurationResolver.java
+++ b/idp-profile-impl/src/main/java/net/shibboleth/idp/relyingparty/impl/DefaultRelyingPartyConfigurationResolver.java
@@ -22,6 +22,7 @@ import java.util.Collections;
import java.util.HashSet;
import java.util.List;
import java.util.function.Predicate;
+import java.util.stream.Collectors;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
@@ -31,6 +32,7 @@ import net.shibboleth.idp.profile.config.SecurityConfiguration;
import net.shibboleth.idp.profile.logic.VerifiedProfilePredicate;
import net.shibboleth.idp.relyingparty.RelyingPartyConfiguration;
import net.shibboleth.idp.relyingparty.RelyingPartyConfigurationResolver;
+import net.shibboleth.idp.relyingparty.RelyingPartyResolverCredentialHolder;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
@@ -45,6 +47,8 @@ import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.security.credential.Credential;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Qualifier;
/**
* Retrieves a per-relying party configuration for a given profile request based on the request context.
@@ -88,7 +92,7 @@ public class DefaultRelyingPartyConfigurationResolver
signingCredentials = Collections.emptyList();
encryptionCredentials = Collections.emptyList();
}
-
+
/**
* Get an unmodifiable list of verified relying party configurations.
*
@@ -291,9 +295,16 @@ public class DefaultRelyingPartyConfigurationResolver
*
* @param credentials the list of signing credentials, may be null
*/
- public void setSigningCredentials(@Nullable @NonnullElements final List<Credential> credentials) {
+ @Autowired
+ @Qualifier("signing")
+ public void setSigningCredentials(
+ @Nullable @NonnullElements final List<RelyingPartyResolverCredentialHolder> credentials) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
if (credentials != null) {
- signingCredentials = List.copyOf(credentials);
+ signingCredentials = credentials.stream()
+ .flatMap(h -> h.getCredentials().stream())
+ .collect(Collectors.toUnmodifiableList());
} else {
signingCredentials = Collections.emptyList();
}
@@ -313,9 +324,16 @@ public class DefaultRelyingPartyConfigurationResolver
*
* @param credentials the list of encryption credentials, may be null
*/
- public void setEncryptionCredentials(@Nullable @NonnullElements final List<Credential> credentials) {
+ @Autowired
+ @Qualifier("encryption")
+ public void setEncryptionCredentials(
+ @Nullable @NonnullElements final List<RelyingPartyResolverCredentialHolder> credentials) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
if (credentials != null) {
- encryptionCredentials = List.copyOf(credentials);
+ encryptionCredentials = credentials.stream()
+ .flatMap(h -> h.getCredentials().stream())
+ .collect(Collectors.toUnmodifiableList());
} else {
encryptionCredentials = Collections.emptyList();
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list