[java-identity-provider] branch main updated: Parent config beans and other wiring related to encryption via key agreement

[Brent Putman]

This is an automated email from the git hooks/post-receive script.

putmanb pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=809fce3bceacfb26bce01129b7ee024048104763

The following commit(s) were added to refs/heads/main by this push:
       new  809fce3bc Parent config beans and other wiring related to encryption via key agreement
809fce3bc is described below

commit 809fce3bceacfb26bce01129b7ee024048104763
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Thu Feb 25 23:54:11 2021 -0500

    Parent config beans and other wiring related to encryption via key agreement
---
 .../net/shibboleth/idp/conf/relying-party-system.xml      | 15 +++++++++++++++
 .../resources/net/shibboleth/idp/conf/security-system.xml |  3 ++-
 idp-conf/src/main/resources/conf/idp.properties           |  4 ++++
 .../metadata/filter/impl/SignatureValidationParser.java   |  2 ++
 4 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-system.xml
index d394a29e2..230397741 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-system.xml
@@ -309,6 +309,19 @@
             </list>
         </property>
     </bean>
+    
+    <!-- Beans related to configuration of key agreement, mostly to provide abstract parent beans for impl classes -->
+    
+    <bean id="shibboleth.KeyAgreement.Configuration" abstract="true"
+        class="org.opensaml.saml.security.SAMLMetadataKeyAgreementEncryptionConfiguration" />
+
+    <bean id="shibboleth.KeyAgreement.ConcatKDF" abstract="true" class="org.opensaml.xmlsec.derivation.impl.ConcatKDF" />
+
+    <bean id="shibboleth.KeyAgreement.PBKDF2" abstract="true" class="org.opensaml.xmlsec.derivation.impl.PBKDF2" />
+
+    <bean id="shibboleth.KeyAgreement.DigestMethod" abstract="true" class="org.opensaml.xmlsec.agreement.impl.DigestMethod" />
+
+    <bean id="shibboleth.KeyAgreement.KANonce" abstract="true" class="org.opensaml.xmlsec.agreement.impl.KANonce" />
 
     <bean id="shibboleth.MetadataPKIXValidationInformationResolver"
         class="net.shibboleth.idp.saml.security.impl.MetadataPKIXValidationInformationResolver"
@@ -370,8 +383,10 @@
                         <list>
                             <bean class="org.opensaml.xmlsec.keyinfo.impl.provider.RSAKeyValueProvider" />
                             <bean class="org.opensaml.xmlsec.keyinfo.impl.provider.DSAKeyValueProvider" />
+                            <bean class="org.opensaml.xmlsec.keyinfo.impl.provider.ECKeyValueProvider" />
                             <bean class="org.opensaml.xmlsec.keyinfo.impl.provider.DEREncodedKeyValueProvider" />
                             <bean class="org.opensaml.xmlsec.keyinfo.impl.provider.InlineX509DataProvider" />
+                            <bean class="org.opensaml.xmlsec.keyinfo.impl.provider.AgreementMethodKeyInfoProvider" />
                         </list>
                     </constructor-arg>
                 </bean>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/security-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/security-system.xml
index a43cff844..efb7f9e06 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/security-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/security-system.xml
@@ -76,7 +76,8 @@
         class="org.opensaml.xmlsec.impl.BasicDecryptionParametersResolver" />
     <bean id="shibboleth.EncryptionParametersResolver"
         class="org.opensaml.saml.security.impl.SAMLMetadataEncryptionParametersResolver"
-        c:resolver-ref="shibboleth.MetadataCredentialResolver" />
+        c:resolver-ref="shibboleth.MetadataCredentialResolver"
+        p:defaultKeyAgreementUseKeyWrap="%{idp.encryption.keyagreement.metadata.defaultUseKeyWrap:Default}" />
     <bean id="shibboleth.ClientTLSValidationParametersResolver"
         class="org.opensaml.security.x509.tls.impl.BasicClientTLSValidationParametersResolver" />
     <bean id="shibboleth.HttpClientSecurityParametersResolver"
diff --git a/idp-conf/src/main/resources/conf/idp.properties b/idp-conf/src/main/resources/conf/idp.properties
index 32411e8f2..b560da38f 100644
--- a/idp-conf/src/main/resources/conf/idp.properties
+++ b/idp-conf/src/main/resources/conf/idp.properties
@@ -76,6 +76,10 @@ idp.encryption.cert = %{idp.home}/credentials/idp-encryption.crt
 # The new install default for encryption is now AES-GCM.
 idp.encryption.config = shibboleth.EncryptionConfiguration.GCM
 
+# Sets the default strategy for key agreement key wrap usage for credentials from metadata,
+# if not otherwise configured on the security configuration
+#idp.encryption.keyagreement.metadata.defaultUseKeyWrap = Default
+
 # Configures trust evaluation of keys used by services at runtime
 # Internal default is Chaining, overriden for new installs
 idp.trust.signatures = shibboleth.ExplicitKeySignatureTrustEngine
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/impl/SignatureValidationParser.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/impl/SignatureValidationParser.java
index bc7bba63f..5a97f9db7 100644
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/impl/SignatureValidationParser.java
+++ b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/impl/SignatureValidationParser.java
@@ -28,6 +28,7 @@ import org.opensaml.security.credential.impl.StaticCredentialResolver;
 import org.opensaml.xmlsec.keyinfo.impl.BasicProviderKeyInfoCredentialResolver;
 import org.opensaml.xmlsec.keyinfo.impl.KeyInfoProvider;
 import org.opensaml.xmlsec.keyinfo.impl.provider.DSAKeyValueProvider;
+import org.opensaml.xmlsec.keyinfo.impl.provider.ECKeyValueProvider;
 import org.opensaml.xmlsec.keyinfo.impl.provider.InlineX509DataProvider;
 import org.opensaml.xmlsec.keyinfo.impl.provider.RSAKeyValueProvider;
 import org.opensaml.xmlsec.signature.support.impl.ExplicitKeySignatureTrustEngine;
@@ -175,6 +176,7 @@ public class SignatureValidationParser extends AbstractCustomBeanDefinitionParse
         final List<KeyInfoProvider> keyInfoProviders = new ArrayList<>();
         keyInfoProviders.add(new DSAKeyValueProvider());
         keyInfoProviders.add(new RSAKeyValueProvider());
+        keyInfoProviders.add(new ECKeyValueProvider());
         keyInfoProviders.add(new InlineX509DataProvider());
         trustEngineBuilder.addConstructorArgValue(new BasicProviderKeyInfoCredentialResolver(keyInfoProviders));
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.