[java-identity-provider] branch main updated: IDP-2020 - SecurityConfiguration on is SAML-specific
Scott Cantor
cantor.2 at osu.edu
Thu Oct 13 18:59:08 UTC 2022
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=0ebec632e45fbb16729f4e3e3feb594e1d8e7291
The following commit(s) were added to refs/heads/main by this push:
new 0ebec632e IDP-2020 - SecurityConfiguration on is SAML-specific
0ebec632e is described below
commit 0ebec632e45fbb16729f4e3e3feb594e1d8e7291
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Oct 13 14:59:05 2022 -0400
IDP-2020 - SecurityConfiguration on is SAML-specific
https://shibboleth.atlassian.net/browse/IDP-2020
Initial refactor into base and XML interfaces and implementations.
---
.../cas/config/AbstractProtocolConfiguration.java | 3 +-
.../shibboleth/idp/conf/relying-party-system.xml | 4 +-
.../net/shibboleth/idp/conf/security-system.xml | 5 -
.../idp/flows/saml/saml2/common-beans.xml | 11 --
.../profile/config/BasicSecurityConfiguration.java | 113 ++++++++++++++
.../config/BasicXMLSecurityConfiguration.java | 124 +++++++++++++++
.../idp/profile/config/SecurityConfiguration.java | 167 ++-------------------
.../profile/config/XMLSecurityConfiguration.java | 62 ++++++++
.../DecryptionConfigurationLookupFunction.java | 9 +-
.../EncryptionConfigurationLookupFunction.java | 9 +-
.../SelfEncryptionConfigurationLookupFunction.java | 102 -------------
...ignatureSigningConfigurationLookupFunction.java | 9 +-
...atureValidationConfigurationLookupFunction.java | 10 +-
...ignatureSigningConfigurationLookupFunction.java | 10 +-
...atureValidationConfigurationLookupFunction.java | 10 +-
.../tests/AbstractProfileConfigurationTest.java | 9 +-
.../saml2/profile/impl/AddAuthnRequestTest.java | 4 +-
.../impl/AddAuthnStatementToAssertionTest.java | 6 +-
.../MockAuthenticationProfileConfiguration.java | 4 +-
.../profile/testing/MockProfileConfiguration.java | 4 +-
.../profile/testing/SAML1ActionTestingSupport.java | 13 +-
.../profile/testing/SAML2ActionTestingSupport.java | 13 +-
22 files changed, 372 insertions(+), 329 deletions(-)
diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/config/AbstractProtocolConfiguration.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/config/AbstractProtocolConfiguration.java
index 39fe808b3..d22351316 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/config/AbstractProtocolConfiguration.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/config/AbstractProtocolConfiguration.java
@@ -27,6 +27,7 @@ import javax.annotation.Nullable;
import net.shibboleth.idp.cas.ticket.TicketIdentifierGenerationStrategy;
import net.shibboleth.idp.profile.config.AbstractConditionalProfileConfiguration;
import net.shibboleth.idp.profile.config.AttributeResolvingProfileConfiguration;
+import net.shibboleth.idp.profile.config.BasicSecurityConfiguration;
import net.shibboleth.idp.profile.config.SecurityConfiguration;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.component.InitializableComponent;
@@ -71,7 +72,7 @@ public abstract class AbstractProtocolConfiguration extends AbstractConditionalP
resolveAttributesPredicate = Predicates.alwaysTrue();
ticketValidityPeriodLookupStrategy = FunctionSupport.constant(DEFAULT_TICKET_VALIDITY_PERIOD);
- defaultSecurityConfiguration = new SecurityConfiguration(Duration.ofMinutes(5),
+ defaultSecurityConfiguration = new BasicSecurityConfiguration(Duration.ofMinutes(5),
new TicketIdentifierGenerationStrategy(getDefaultTicketPrefix(), getDefaultTicketLength()));
}
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-system.xml
index b6d7521ee..0c6210e5a 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-system.xml
@@ -155,8 +155,7 @@
and loads the default credentials used.
-->
- <bean id="shibboleth.DefaultSecurityConfiguration" class="net.shibboleth.idp.profile.config.SecurityConfiguration">
-
+ <bean id="shibboleth.DefaultSecurityConfiguration" class="net.shibboleth.idp.profile.config.BasicXMLSecurityConfiguration">
<property name="signatureSigningConfiguration">
<ref bean="#{'%{idp.signing.config:shibboleth.SigningConfiguration.SHA256}'.trim()}" />
</property>
@@ -186,7 +185,6 @@
p:KEKKeyInfoCredentialResolver-ref="defaultKeyEncryptionCredentialResolver"
p:encryptedKeyResolver-ref="defaultEncryptedKeyResolver" />
</property>
-
</bean>
<!-- KeyInfoGeneration machinery. Former gets injected into the signing and encryption configs. -->
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/security-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/security-system.xml
index 6e6ebda29..7e127a9d8 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/security-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/security-system.xml
@@ -65,11 +65,6 @@
<bean id="shibboleth.ClientTLSValidationConfigurationLookup" lazy-init="true"
class="net.shibboleth.idp.profile.config.navigate.ClientTLSValidationConfigurationLookupFunction"
p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
- <bean id="shibboleth.SelfEncryptionConfigurationLookup" lazy-init="true"
- class="net.shibboleth.idp.profile.config.navigate.SelfEncryptionConfigurationLookupFunction"
- p:selfConfiguration="#{getObject('shibboleth.SelfEncryptionConfiguration')}"
- p:includeProfileDefaultConfiguration="%{idp.encryption.self.includeProfileDefaultConfiguration:false}"
- p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
<!-- Beans that implement the mashing of security configurations into final parameter sets. -->
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/common-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/common-beans.xml
index 7e6401077..9e08c4cea 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/common-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/common-beans.xml
@@ -95,17 +95,6 @@
<bean class="net.shibboleth.idp.profile.context.navigate.SpringStatusMessageLookupFunction" />
</property>
</bean>
-
- <bean id="EncryptToSelfParametersStrategy" class="org.opensaml.saml.security.impl.InlineSelfEncryptionParametersStrategy">
- <constructor-arg>
- <bean class="net.shibboleth.idp.relyingparty.impl.EncryptionCredentialsResolver"
- c:_0-ref="shibboleth.RelyingPartyResolverService" />
- </constructor-arg>
- <constructor-arg>
- <bean class="org.opensaml.xmlsec.impl.BasicEncryptionParametersResolver" />
- </constructor-arg>
- <constructor-arg ref="shibboleth.SelfEncryptionConfigurationLookup" />
- </bean>
<!-- Default formats not to encrypt. -->
<util:set id="DefaultPlaintextNameIDFormats">
diff --git a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/BasicSecurityConfiguration.java b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/BasicSecurityConfiguration.java
new file mode 100644
index 000000000..453bdd29c
--- /dev/null
+++ b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/BasicSecurityConfiguration.java
@@ -0,0 +1,113 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.profile.config;
+
+import java.time.Duration;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.security.IdentifierGenerationStrategy;
+import net.shibboleth.shared.security.IdentifierGenerationStrategy.ProviderType;
+
+import org.opensaml.security.httpclient.HttpClientSecurityConfiguration;
+import org.opensaml.security.x509.tls.ClientTLSValidationConfiguration;
+
+/**
+ * Basic implementation of {@link SecurityConfiguration} interface.
+ *
+ * @since 5.0.0
+ */
+public class BasicSecurityConfiguration implements SecurityConfiguration {
+
+ /** Acceptable clock skew. */
+ @Nonnull private final Duration clockSkew;
+
+ /** Generator used to generate various secure IDs (e.g., message identifiers). */
+ @Nonnull private final IdentifierGenerationStrategy idGenerator;
+
+ /** Configuration used when validating client TLS X509Credentials. */
+ @Nullable private ClientTLSValidationConfiguration clientTLSConfig;
+
+ /** Configuration used when executing HttpClient requests. */
+ @Nullable private HttpClientSecurityConfiguration httpClientConfig;
+
+ /**
+ * Constructor.
+ *
+ * Initializes the clock skew to 5 minutes and the identifier generator to {@link ProviderType#SECURE}.
+ */
+ public BasicSecurityConfiguration() {
+ clockSkew = Duration.ofMinutes(5);
+ idGenerator = IdentifierGenerationStrategy.getInstance(ProviderType.SECURE);
+ }
+
+ /**
+ * Constructor.
+ *
+ * @param skew the clock skew, must be greater than 0
+ * @param generator the identifier generator, must not be null
+ */
+ public BasicSecurityConfiguration(@Nonnull final Duration skew, @Nonnull final IdentifierGenerationStrategy generator) {
+ Constraint.isNotNull(skew, "Clock skew cannot be null");
+ Constraint.isFalse(skew.isNegative() || skew.isZero(), "Clock skew must be greater than 0");
+
+ clockSkew = skew;
+ idGenerator = Constraint.isNotNull(generator, "Identifier generator cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public Duration getClockSkew() {
+ return clockSkew;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public IdentifierGenerationStrategy getIdGenerator() {
+ return idGenerator;
+ }
+
+ /** {@inheritDoc} */
+ @Nullable public ClientTLSValidationConfiguration getClientTLSValidationConfiguration() {
+ return clientTLSConfig;
+ }
+
+ /**
+ * Set the configuration used when validating client TLS X509Credentials.
+ *
+ * @param config configuration used when validating client TLS X509Credentials, or null
+ */
+ public void setClientTLSValidationConfiguration(@Nullable final ClientTLSValidationConfiguration config) {
+ clientTLSConfig = config;
+ }
+
+ /** {@inheritDoc} */
+ @Nullable public HttpClientSecurityConfiguration getHttpClientSecurityConfiguration() {
+ return httpClientConfig;
+ }
+
+ /**
+ * Set the configuration used when executing HttpClient requests.
+ *
+ * @param config configuration used when executing HttpClient requests, or null
+ */
+ public void setHttpClientSecurityConfiguration(@Nullable final HttpClientSecurityConfiguration config) {
+ httpClientConfig = config;
+ }
+
+}
\ No newline at end of file
diff --git a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/BasicXMLSecurityConfiguration.java b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/BasicXMLSecurityConfiguration.java
new file mode 100644
index 000000000..1f0261342
--- /dev/null
+++ b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/BasicXMLSecurityConfiguration.java
@@ -0,0 +1,124 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.profile.config;
+
+import java.time.Duration;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import net.shibboleth.shared.security.IdentifierGenerationStrategy;
+
+import org.opensaml.xmlsec.DecryptionConfiguration;
+import org.opensaml.xmlsec.EncryptionConfiguration;
+import org.opensaml.xmlsec.SignatureSigningConfiguration;
+import org.opensaml.xmlsec.SignatureValidationConfiguration;
+
+/**
+ * Basic implementation of {@link XMLSecurityConfiguration} interface.
+ *
+ * @since 5.0.0
+ */
+public class BasicXMLSecurityConfiguration extends BasicSecurityConfiguration implements XMLSecurityConfiguration {
+
+ /** Configuration used when validating protocol message signatures. */
+ @Nullable private SignatureValidationConfiguration sigValidateConfig;
+
+ /** Configuration used when generating protocol message signatures. */
+ @Nullable private SignatureSigningConfiguration sigSigningConfig;
+
+ /** Configuration used when decrypting protocol message information. */
+ @Nullable private DecryptionConfiguration decryptConfig;
+
+ /** Configuration used when encrypting protocol message information. */
+ @Nullable private EncryptionConfiguration encryptConfig;
+
+ /**
+ * Default constructor.
+ */
+ public BasicXMLSecurityConfiguration() {
+
+ }
+
+ /**
+ * Constructor.
+ *
+ * @param skew the clock skew, must be greater than 0
+ * @param generator the identifier generator, must not be null
+ */
+ public BasicXMLSecurityConfiguration(@Nonnull final Duration skew, @Nonnull final IdentifierGenerationStrategy generator) {
+ super(skew, generator);
+ }
+
+ /** {@inheritDoc} */
+ @Nullable public SignatureValidationConfiguration getSignatureValidationConfiguration() {
+ return sigValidateConfig;
+ }
+
+ /**
+ * Set the configuration used when validating protocol message signatures.
+ *
+ * @param config configuration used when validating protocol message signatures, or null
+ */
+ public void setSignatureValidationConfiguration(@Nullable final SignatureValidationConfiguration config) {
+ sigValidateConfig = config;
+ }
+
+ /** {@inheritDoc} */
+ @Nullable public SignatureSigningConfiguration getSignatureSigningConfiguration() {
+ return sigSigningConfig;
+ }
+
+ /**
+ * Set the configuration used when generating protocol message signatures.
+ *
+ * @param config configuration used when generating protocol message signatures, or null
+ */
+ public void setSignatureSigningConfiguration(@Nullable final SignatureSigningConfiguration config) {
+ sigSigningConfig = config;
+ }
+
+ /** {@inheritDoc} */
+ @Nullable public DecryptionConfiguration getDecryptionConfiguration() {
+ return decryptConfig;
+ }
+
+ /**
+ * Set the configuration used when decrypting protocol message information.
+ *
+ * @param config configuration used when decrypting protocol message information, or null
+ */
+ public void setDecryptionConfiguration(@Nullable final DecryptionConfiguration config) {
+ decryptConfig = config;
+ }
+
+ /** {@inheritDoc} */
+ @Nullable public EncryptionConfiguration getEncryptionConfiguration() {
+ return encryptConfig;
+ }
+
+ /**
+ * Set the configuration used when encrypting protocol message information.
+ *
+ * @param config configuration used when encrypting protocol message information, or null
+ */
+ public void setEncryptionConfiguration(@Nullable final EncryptionConfiguration config) {
+ encryptConfig = config;
+ }
+
+}
\ No newline at end of file
diff --git a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/SecurityConfiguration.java b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/SecurityConfiguration.java
index 095fccd44..f373c93ef 100644
--- a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/SecurityConfiguration.java
+++ b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/SecurityConfiguration.java
@@ -22,191 +22,42 @@ import java.time.Duration;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.security.IdentifierGenerationStrategy;
-import net.shibboleth.shared.security.IdentifierGenerationStrategy.ProviderType;
-
import org.opensaml.security.httpclient.HttpClientSecurityConfiguration;
import org.opensaml.security.x509.tls.ClientTLSValidationConfiguration;
-import org.opensaml.xmlsec.DecryptionConfiguration;
-import org.opensaml.xmlsec.EncryptionConfiguration;
-import org.opensaml.xmlsec.SignatureSigningConfiguration;
-import org.opensaml.xmlsec.SignatureValidationConfiguration;
-
-/** Configuration for security behavior of profiles. */
-public class SecurityConfiguration {
-
- /** Acceptable clock skew. */
- @Nonnull private final Duration clockSkew;
-
- /** Generator used to generate various secure IDs (e.g., message identifiers). */
- @Nonnull private final IdentifierGenerationStrategy idGenerator;
-
- /** Configuration used when validating protocol message signatures. */
- @Nullable private SignatureValidationConfiguration sigValidateConfig;
-
- /** Configuration used when generating protocol message signatures. */
- @Nullable private SignatureSigningConfiguration sigSigningConfig;
- /** Configuration used when decrypting protocol message information. */
- @Nullable private DecryptionConfiguration decryptConfig;
-
- /** Configuration used when encrypting protocol message information. */
- @Nullable private EncryptionConfiguration encryptConfig;
-
- /** Configuration used when validating client TLS X509Credentials. */
- @Nullable private ClientTLSValidationConfiguration clientTLSConfig;
-
- /** Configuration used when executing HttpClient requests. */
- @Nullable private HttpClientSecurityConfiguration httpClientConfig;
-
- /**
- * Constructor.
- *
- * Initializes the clock skew to 5 minutes and the identifier generator to {@link ProviderType#SECURE}.
- */
- public SecurityConfiguration() {
- clockSkew = Duration.ofMinutes(5);
- idGenerator = IdentifierGenerationStrategy.getInstance(ProviderType.SECURE);
- }
+import net.shibboleth.shared.security.IdentifierGenerationStrategy;
- /**
- * Constructor.
- *
- * @param skew the clock skew, must be greater than 0
- * @param generator the identifier generator, must not be null
- */
- public SecurityConfiguration(@Nonnull final Duration skew, @Nonnull final IdentifierGenerationStrategy generator) {
- Constraint.isNotNull(skew, "Clock skew cannot be null");
- Constraint.isFalse(skew.isNegative() || skew.isZero(), "Clock skew must be greater than 0");
-
- clockSkew = skew;
- idGenerator = Constraint.isNotNull(generator, "Identifier generator cannot be null");
- }
+/**
+ * General security settings for profiles.
+ */
+public interface SecurityConfiguration {
/**
* Get the acceptable clock skew.
*
* @return acceptable clock skew
*/
- @Nonnull public Duration getClockSkew() {
- return clockSkew;
- }
+ @Nonnull Duration getClockSkew();
/**
* Get the generator used to generate secure identifiers.
*
* @return generator used to generate secure identifiers
*/
- @Nonnull public IdentifierGenerationStrategy getIdGenerator() {
- return idGenerator;
- }
-
- /**
- * Get the configuration used when validating protocol message signatures.
- *
- * @return configuration used when validating protocol message signatures, or null
- */
- @Nullable public SignatureValidationConfiguration getSignatureValidationConfiguration() {
- return sigValidateConfig;
- }
-
- /**
- * Set the configuration used when validating protocol message signatures.
- *
- * @param config configuration used when validating protocol message signatures, or null
- */
- public void setSignatureValidationConfiguration(@Nullable final SignatureValidationConfiguration config) {
- sigValidateConfig = config;
- }
-
- /**
- * Get the configuration used when generating protocol message signatures.
- *
- * @return configuration used when generating protocol message signatures, or null
- */
- @Nullable public SignatureSigningConfiguration getSignatureSigningConfiguration() {
- return sigSigningConfig;
- }
-
- /**
- * Set the configuration used when generating protocol message signatures.
- *
- * @param config configuration used when generating protocol message signatures, or null
- */
- public void setSignatureSigningConfiguration(@Nullable final SignatureSigningConfiguration config) {
- sigSigningConfig = config;
- }
-
- /**
- * Get the configuration used when decrypting protocol message information.
- *
- * @return configuration used when decrypting protocol message information, or null
- */
- @Nullable public DecryptionConfiguration getDecryptionConfiguration() {
- return decryptConfig;
- }
-
- /**
- * Set the configuration used when decrypting protocol message information.
- *
- * @param config configuration used when decrypting protocol message information, or null
- */
- public void setDecryptionConfiguration(@Nullable final DecryptionConfiguration config) {
- decryptConfig = config;
- }
-
- /**
- * Get the configuration used when encrypting protocol message information.
- *
- * @return configuration used when encrypting protocol message information, or null
- */
- @Nullable public EncryptionConfiguration getEncryptionConfiguration() {
- return encryptConfig;
- }
-
- /**
- * Set the configuration used when encrypting protocol message information.
- *
- * @param config configuration used when encrypting protocol message information, or null
- */
- public void setEncryptionConfiguration(@Nullable final EncryptionConfiguration config) {
- encryptConfig = config;
- }
+ @Nonnull IdentifierGenerationStrategy getIdGenerator();
/**
* Get the configuration used when validating client TLS X509Credentials.
*
* @return configuration used when validating client TLS X509Credentials, or null
*/
- @Nullable public ClientTLSValidationConfiguration getClientTLSValidationConfiguration() {
- return clientTLSConfig;
- }
+ @Nullable ClientTLSValidationConfiguration getClientTLSValidationConfiguration();
- /**
- * Set the configuration used when validating client TLS X509Credentials.
- *
- * @param config configuration used when validating client TLS X509Credentials, or null
- */
- public void setClientTLSValidationConfiguration(final ClientTLSValidationConfiguration config) {
- clientTLSConfig = config;
- }
-
/**
* Get the configuration used when executing HttpClient requests.
*
* @return configuration used when executing HttpClient requests, or null
*/
- @Nullable public HttpClientSecurityConfiguration getHttpClientSecurityConfiguration() {
- return httpClientConfig;
- }
+ @Nullable HttpClientSecurityConfiguration getHttpClientSecurityConfiguration();
- /**
- * Set the configuration used when executing HttpClient requests.
- *
- * @param config configuration used when executing HttpClient requests, or null
- */
- public void setHttpClientSecurityConfiguration(final HttpClientSecurityConfiguration config) {
- httpClientConfig = config;
- }
}
\ No newline at end of file
diff --git a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/XMLSecurityConfiguration.java b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/XMLSecurityConfiguration.java
new file mode 100644
index 000000000..11bb8623a
--- /dev/null
+++ b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/XMLSecurityConfiguration.java
@@ -0,0 +1,62 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.profile.config;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.xmlsec.DecryptionConfiguration;
+import org.opensaml.xmlsec.EncryptionConfiguration;
+import org.opensaml.xmlsec.SignatureSigningConfiguration;
+import org.opensaml.xmlsec.SignatureValidationConfiguration;
+
+/**
+ * Extends base interface with XML Security configuration objects.
+ *
+ * @since 5.0.0
+ */
+public interface XMLSecurityConfiguration extends SecurityConfiguration {
+
+ /**
+ * Get the configuration used when validating protocol message signatures.
+ *
+ * @return configuration used when validating protocol message signatures, or null
+ */
+ @Nullable SignatureValidationConfiguration getSignatureValidationConfiguration();
+
+ /**
+ * Get the configuration used when generating protocol message signatures.
+ *
+ * @return configuration used when generating protocol message signatures, or null
+ */
+ @Nullable SignatureSigningConfiguration getSignatureSigningConfiguration();
+
+ /**
+ * Get the configuration used when decrypting protocol message information.
+ *
+ * @return configuration used when decrypting protocol message information, or null
+ */
+ @Nullable DecryptionConfiguration getDecryptionConfiguration();
+
+ /**
+ * Get the configuration used when encrypting protocol message information.
+ *
+ * @return configuration used when encrypting protocol message information, or null
+ */
+ @Nullable EncryptionConfiguration getEncryptionConfiguration();
+
+}
\ No newline at end of file
diff --git a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/navigate/DecryptionConfigurationLookupFunction.java b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/navigate/DecryptionConfigurationLookupFunction.java
index 89fac7104..7f35150cd 100644
--- a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/navigate/DecryptionConfigurationLookupFunction.java
+++ b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/navigate/DecryptionConfigurationLookupFunction.java
@@ -24,6 +24,7 @@ import javax.annotation.Nullable;
import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.config.SecurityConfiguration;
+import net.shibboleth.idp.profile.config.XMLSecurityConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
import net.shibboleth.idp.relyingparty.RelyingPartyConfigurationResolver;
@@ -63,8 +64,8 @@ public class DecryptionConfigurationLookupFunction
final ProfileConfiguration pc = rpc.getProfileConfig();
if (pc != null) {
final SecurityConfiguration sc = pc.getSecurityConfiguration(input);
- if (sc != null && sc.getDecryptionConfiguration() != null) {
- configs.add(sc.getDecryptionConfiguration());
+ if (sc instanceof XMLSecurityConfiguration xsc && xsc.getDecryptionConfiguration() != null) {
+ configs.add(xsc.getDecryptionConfiguration());
}
}
}
@@ -73,8 +74,8 @@ public class DecryptionConfigurationLookupFunction
if (input != null && rpResolver != null) {
final SecurityConfiguration defaultConfig =
rpResolver.getDefaultSecurityConfiguration(input.getProfileId());
- if (defaultConfig != null && defaultConfig.getDecryptionConfiguration() != null) {
- configs.add(defaultConfig.getDecryptionConfiguration());
+ if (defaultConfig instanceof XMLSecurityConfiguration xsc && xsc.getDecryptionConfiguration() != null) {
+ configs.add(xsc.getDecryptionConfiguration());
}
}
diff --git a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/navigate/EncryptionConfigurationLookupFunction.java b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/navigate/EncryptionConfigurationLookupFunction.java
index 4333735b0..20c48174e 100644
--- a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/navigate/EncryptionConfigurationLookupFunction.java
+++ b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/navigate/EncryptionConfigurationLookupFunction.java
@@ -24,6 +24,7 @@ import javax.annotation.Nullable;
import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.config.SecurityConfiguration;
+import net.shibboleth.idp.profile.config.XMLSecurityConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
import net.shibboleth.idp.relyingparty.RelyingPartyConfigurationResolver;
@@ -63,8 +64,8 @@ public class EncryptionConfigurationLookupFunction
final ProfileConfiguration pc = rpc.getProfileConfig();
if (pc != null) {
final SecurityConfiguration sc = pc.getSecurityConfiguration(input);
- if (sc != null && sc.getEncryptionConfiguration() != null) {
- configs.add(sc.getEncryptionConfiguration());
+ if (sc instanceof XMLSecurityConfiguration xsc && xsc.getEncryptionConfiguration() != null) {
+ configs.add(xsc.getEncryptionConfiguration());
}
}
}
@@ -73,8 +74,8 @@ public class EncryptionConfigurationLookupFunction
if (input != null && rpResolver != null) {
final SecurityConfiguration defaultConfig =
rpResolver.getDefaultSecurityConfiguration(input.getProfileId());
- if (defaultConfig != null && defaultConfig.getEncryptionConfiguration() != null) {
- configs.add(defaultConfig.getEncryptionConfiguration());
+ if (defaultConfig instanceof XMLSecurityConfiguration xsc && xsc.getEncryptionConfiguration() != null) {
+ configs.add(xsc.getEncryptionConfiguration());
}
}
diff --git a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/navigate/SelfEncryptionConfigurationLookupFunction.java b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/navigate/SelfEncryptionConfigurationLookupFunction.java
deleted file mode 100644
index f248191be..000000000
--- a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/navigate/SelfEncryptionConfigurationLookupFunction.java
+++ /dev/null
@@ -1,102 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.config.navigate;
-
-import java.util.ArrayList;
-import java.util.List;
-import java.util.function.Function;
-
-import javax.annotation.Nullable;
-
-import net.shibboleth.idp.profile.config.SecurityConfiguration;
-import net.shibboleth.idp.relyingparty.RelyingPartyConfigurationResolver;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.xmlsec.EncryptionConfiguration;
-import org.opensaml.xmlsec.SecurityConfigurationSupport;
-
-/**
- * A function that returns a {@link EncryptionConfiguration} list intended for self-encryption cases.
- *
- * <p>A self-specific {@link EncryptionConfiguration} may be supplied. This, if present will be composed
- * with the global config {@link SecurityConfigurationSupport#getGlobalEncryptionConfiguration()}</p>
- */
-public class SelfEncryptionConfigurationLookupFunction
- implements Function<ProfileRequestContext,List<EncryptionConfiguration>> {
-
- /** The self-encryption configuration. */
- @Nullable private EncryptionConfiguration selfConfig;
-
- /** A resolver for default security configurations. */
- @Nullable private RelyingPartyConfigurationResolver rpResolver;
-
- /** Flag indicating whether the profile default configuration should be included in the returned list. */
- private boolean includeProfileDefaultConfiguration;
-
- /**
- * Set the resolver for default security configurations.
- *
- * @param resolver the resolver to use
- */
- public void setRelyingPartyConfigurationResolver(@Nullable final RelyingPartyConfigurationResolver resolver) {
- rpResolver = resolver;
- }
-
- /**
- * Set the self-encryption configuration.
- *
- * @param config the self-encryption {@link EncryptionConfiguration}
- */
- public void setSelfConfiguration(@Nullable final EncryptionConfiguration config) {
- selfConfig = config;
- }
-
- /**
- * Set the flag indicating whether the profile default configuration should be included in the returned list.
- *
- * @param flag true if profile default should be included, false otherwise
- */
- public void setIncludeProfileDefaultConfiguration(final boolean flag) {
- includeProfileDefaultConfiguration = flag;
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable public List<EncryptionConfiguration> apply(@Nullable final ProfileRequestContext input) {
-
- final List<EncryptionConfiguration> configs = new ArrayList<>();
-
- if (selfConfig != null) {
- configs.add(selfConfig);
- }
-
- // Check for a per-profile default config.
- if (includeProfileDefaultConfiguration && input != null && rpResolver != null) {
- final SecurityConfiguration defaultConfig =
- rpResolver.getDefaultSecurityConfiguration(input.getProfileId());
- if (defaultConfig != null && defaultConfig.getEncryptionConfiguration() != null) {
- configs.add(defaultConfig.getEncryptionConfiguration());
- }
- }
-
- configs.add(SecurityConfigurationSupport.getGlobalEncryptionConfiguration());
-
- return configs;
- }
-
-}
\ No newline at end of file
diff --git a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/navigate/SignatureSigningConfigurationLookupFunction.java b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/navigate/SignatureSigningConfigurationLookupFunction.java
index fde97bb0b..a28ff8651 100644
--- a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/navigate/SignatureSigningConfigurationLookupFunction.java
+++ b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/navigate/SignatureSigningConfigurationLookupFunction.java
@@ -24,6 +24,7 @@ import javax.annotation.Nullable;
import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.config.SecurityConfiguration;
+import net.shibboleth.idp.profile.config.XMLSecurityConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
import net.shibboleth.idp.relyingparty.RelyingPartyConfigurationResolver;
@@ -63,8 +64,8 @@ public class SignatureSigningConfigurationLookupFunction
final ProfileConfiguration pc = rpc.getProfileConfig();
if (pc != null) {
final SecurityConfiguration sc = pc.getSecurityConfiguration(input);
- if (sc != null && sc.getSignatureSigningConfiguration() != null) {
- configs.add(sc.getSignatureSigningConfiguration());
+ if (sc instanceof XMLSecurityConfiguration xsc && xsc.getSignatureSigningConfiguration() != null) {
+ configs.add(xsc.getSignatureSigningConfiguration());
}
}
}
@@ -73,8 +74,8 @@ public class SignatureSigningConfigurationLookupFunction
if (input != null && rpResolver != null) {
final SecurityConfiguration defaultConfig =
rpResolver.getDefaultSecurityConfiguration(input.getProfileId());
- if (defaultConfig != null && defaultConfig.getSignatureSigningConfiguration() != null) {
- configs.add(defaultConfig.getSignatureSigningConfiguration());
+ if (defaultConfig instanceof XMLSecurityConfiguration xsc && xsc.getSignatureSigningConfiguration() != null) {
+ configs.add(xsc.getSignatureSigningConfiguration());
}
}
diff --git a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/navigate/SignatureValidationConfigurationLookupFunction.java b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/navigate/SignatureValidationConfigurationLookupFunction.java
index e5e3778d5..7807daae6 100644
--- a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/navigate/SignatureValidationConfigurationLookupFunction.java
+++ b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/navigate/SignatureValidationConfigurationLookupFunction.java
@@ -24,6 +24,7 @@ import javax.annotation.Nullable;
import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.config.SecurityConfiguration;
+import net.shibboleth.idp.profile.config.XMLSecurityConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
import net.shibboleth.idp.relyingparty.RelyingPartyConfigurationResolver;
@@ -63,8 +64,8 @@ public class SignatureValidationConfigurationLookupFunction
final ProfileConfiguration pc = rpc.getProfileConfig();
if (pc != null) {
final SecurityConfiguration sc = pc.getSecurityConfiguration(input);
- if (sc != null && sc.getSignatureValidationConfiguration() != null) {
- configs.add(sc.getSignatureValidationConfiguration());
+ if (sc instanceof XMLSecurityConfiguration xsc && xsc.getSignatureValidationConfiguration() != null) {
+ configs.add(xsc.getSignatureValidationConfiguration());
}
}
}
@@ -73,8 +74,9 @@ public class SignatureValidationConfigurationLookupFunction
if (input != null && rpResolver != null) {
final SecurityConfiguration defaultConfig =
rpResolver.getDefaultSecurityConfiguration(input.getProfileId());
- if (defaultConfig != null && defaultConfig.getSignatureValidationConfiguration() != null) {
- configs.add(defaultConfig.getSignatureValidationConfiguration());
+ if (defaultConfig instanceof XMLSecurityConfiguration xsc &&
+ xsc.getSignatureValidationConfiguration() != null) {
+ configs.add(xsc.getSignatureValidationConfiguration());
}
}
diff --git a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/navigate/messaging/SignatureSigningConfigurationLookupFunction.java b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/navigate/messaging/SignatureSigningConfigurationLookupFunction.java
index fd9a177f5..054cb4548 100644
--- a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/navigate/messaging/SignatureSigningConfigurationLookupFunction.java
+++ b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/navigate/messaging/SignatureSigningConfigurationLookupFunction.java
@@ -28,6 +28,7 @@ import org.opensaml.xmlsec.SignatureSigningConfiguration;
import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.config.SecurityConfiguration;
+import net.shibboleth.idp.profile.config.XMLSecurityConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.messaging.AbstractRelyingPartyLookupFunction;
import net.shibboleth.idp.relyingparty.RelyingPartyConfigurationResolver;
@@ -65,8 +66,8 @@ public class SignatureSigningConfigurationLookupFunction
if (pc != null) {
final SecurityConfiguration sc =
pc.getSecurityConfiguration(this.getProfileRequestContextLookupStrategy().apply(input));
- if (sc != null && sc.getSignatureSigningConfiguration() != null) {
- configs.add(sc.getSignatureSigningConfiguration());
+ if (sc instanceof XMLSecurityConfiguration xsc && xsc.getSignatureSigningConfiguration() != null) {
+ configs.add(xsc.getSignatureSigningConfiguration());
}
}
@@ -74,8 +75,9 @@ public class SignatureSigningConfigurationLookupFunction
if (pc != null && rpResolver != null) {
final SecurityConfiguration defaultConfig =
rpResolver.getDefaultSecurityConfiguration(pc.getId());
- if (defaultConfig != null && defaultConfig.getSignatureSigningConfiguration() != null) {
- configs.add(defaultConfig.getSignatureSigningConfiguration());
+ if (defaultConfig instanceof XMLSecurityConfiguration xsc &&
+ xsc.getSignatureSigningConfiguration() != null) {
+ configs.add(xsc.getSignatureSigningConfiguration());
}
}
}
diff --git a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/navigate/messaging/SignatureValidationConfigurationLookupFunction.java b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/navigate/messaging/SignatureValidationConfigurationLookupFunction.java
index 4a35980ce..7d971f7f1 100644
--- a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/navigate/messaging/SignatureValidationConfigurationLookupFunction.java
+++ b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/navigate/messaging/SignatureValidationConfigurationLookupFunction.java
@@ -28,6 +28,7 @@ import org.opensaml.xmlsec.SignatureValidationConfiguration;
import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.config.SecurityConfiguration;
+import net.shibboleth.idp.profile.config.XMLSecurityConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.messaging.AbstractRelyingPartyLookupFunction;
import net.shibboleth.idp.relyingparty.RelyingPartyConfigurationResolver;
@@ -65,8 +66,8 @@ public class SignatureValidationConfigurationLookupFunction
if (pc != null) {
final SecurityConfiguration sc =
pc.getSecurityConfiguration(this.getProfileRequestContextLookupStrategy().apply(input));
- if (sc != null && sc.getSignatureValidationConfiguration() != null) {
- configs.add(sc.getSignatureValidationConfiguration());
+ if (sc instanceof XMLSecurityConfiguration xsc && xsc.getSignatureValidationConfiguration() != null) {
+ configs.add(xsc.getSignatureValidationConfiguration());
}
}
@@ -74,8 +75,9 @@ public class SignatureValidationConfigurationLookupFunction
if (pc != null && rpResolver != null) {
final SecurityConfiguration defaultConfig =
rpResolver.getDefaultSecurityConfiguration(pc.getId());
- if (defaultConfig != null && defaultConfig.getSignatureValidationConfiguration() != null) {
- configs.add(defaultConfig.getSignatureValidationConfiguration());
+ if (defaultConfig instanceof XMLSecurityConfiguration xsc &&
+ xsc.getSignatureValidationConfiguration() != null) {
+ configs.add(xsc.getSignatureValidationConfiguration());
}
}
}
diff --git a/idp-profile-impl/src/test/java/net/shibboleth/idp/profile/config/tests/AbstractProfileConfigurationTest.java b/idp-profile-impl/src/test/java/net/shibboleth/idp/profile/config/tests/AbstractProfileConfigurationTest.java
index f78fbd619..4e4cb8c51 100644
--- a/idp-profile-impl/src/test/java/net/shibboleth/idp/profile/config/tests/AbstractProfileConfigurationTest.java
+++ b/idp-profile-impl/src/test/java/net/shibboleth/idp/profile/config/tests/AbstractProfileConfigurationTest.java
@@ -18,6 +18,7 @@
package net.shibboleth.idp.profile.config.tests;
import net.shibboleth.idp.profile.config.AbstractProfileConfiguration;
+import net.shibboleth.idp.profile.config.BasicSecurityConfiguration;
import net.shibboleth.idp.profile.config.SecurityConfiguration;
import net.shibboleth.idp.profile.testing.MockProfileConfiguration;
import net.shibboleth.shared.logic.ConstraintViolationException;
@@ -57,7 +58,7 @@ public class AbstractProfileConfigurationTest {
final MockProfileConfiguration config = new MockProfileConfiguration("mock");
Assert.assertNotNull(config.getSecurityConfiguration(null));
- SecurityConfiguration securityConfig = new SecurityConfiguration();
+ SecurityConfiguration securityConfig = new BasicSecurityConfiguration();
config.setSecurityConfiguration(securityConfig);
Assert.assertSame(config.getSecurityConfiguration(null), securityConfig);
}
@@ -66,7 +67,7 @@ public class AbstractProfileConfigurationTest {
public void testIndirectSecurityConfiguration() {
final MockProfileConfiguration config = new MockProfileConfiguration("mock");
config.setSecurityConfiguration(null);
- final SecurityConfiguration securityConfig = new SecurityConfiguration();
+ final SecurityConfiguration securityConfig = new BasicSecurityConfiguration();
config.setSecurityConfigurationLookupStrategy(FunctionSupport.constant(securityConfig));
Assert.assertSame(config.getSecurityConfiguration(null), securityConfig);
}
@@ -83,7 +84,7 @@ public class AbstractProfileConfigurationTest {
public void testIndirectInboundFlows() {
final MockProfileConfiguration config = new MockProfileConfiguration("mock");
final List<String> flows = Arrays.asList("foo", "bar");
- config.setInboundFlowsLookupStrategy(FunctionSupport.constant(flows));
+ config.setInboundInterceptorFlowsLookupStrategy(FunctionSupport.constant(flows));
Assert.assertEquals(config.getInboundInterceptorFlows(null), flows);
}
@@ -99,7 +100,7 @@ public class AbstractProfileConfigurationTest {
public void testIndirectOutboundFlows() {
final MockProfileConfiguration config = new MockProfileConfiguration("mock");
final List<String> flows = Arrays.asList("foo", "bar");
- config.setOutboundFlowsLookupStrategy(FunctionSupport.constant(flows));
+ config.setOutboundInterceptorFlowsLookupStrategy(FunctionSupport.constant(flows));
Assert.assertEquals(config.getOutboundInterceptorFlows(null), flows);
}
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequestTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequestTest.java
index 411834ab6..f876207da 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequestTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequestTest.java
@@ -26,7 +26,7 @@ import java.util.stream.Collectors;
import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.authn.context.RequestedPrincipalContext;
import net.shibboleth.idp.profile.IdPEventIds;
-import net.shibboleth.idp.profile.config.SecurityConfiguration;
+import net.shibboleth.idp.profile.config.BasicXMLSecurityConfiguration;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
@@ -91,7 +91,7 @@ public class AddAuthnRequestTest extends OpenSAMLInitBaseTestCase {
rp.initialize();
rpc.setConfiguration(rp);
rpc.setProfileConfig(new BrowserSSOProfileConfiguration());
- ((BrowserSSOProfileConfiguration) rpc.getProfileConfig()).setSecurityConfiguration(new SecurityConfiguration());
+ ((BrowserSSOProfileConfiguration) rpc.getProfileConfig()).setSecurityConfiguration(new BasicXMLSecurityConfiguration());
action = new AddAuthnRequest();
action.setProfileContextLookupStrategy(
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnStatementToAssertionTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnStatementToAssertionTest.java
index 1b612b013..641f274d7 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnStatementToAssertionTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnStatementToAssertionTest.java
@@ -47,7 +47,7 @@ import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.authn.context.RequestedPrincipalContext;
import net.shibboleth.idp.authn.impl.DefaultAuthenticationResultSerializer;
import net.shibboleth.idp.authn.principal.ProxyAuthenticationPrincipal;
-import net.shibboleth.idp.profile.config.SecurityConfiguration;
+import net.shibboleth.idp.profile.config.BasicXMLSecurityConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
import net.shibboleth.idp.profile.testing.ActionTestingSupport;
@@ -173,7 +173,7 @@ public class AddAuthnStatementToAssertionTest extends OpenSAMLInitBaseTestCase {
@Test public void testSessionNotOnOrAfter() {
final BrowserSSOProfileConfiguration ssoConfig = new BrowserSSOProfileConfiguration();
ssoConfig.setMaximumSPSessionLifetime(Duration.ofHours(1));
- ssoConfig.setSecurityConfiguration(new SecurityConfiguration());
+ ssoConfig.setSecurityConfiguration(new BasicXMLSecurityConfiguration());
prc.getSubcontext(RelyingPartyContext.class).setProfileConfig(ssoConfig);
prc.getSubcontext(AuthenticationContext.class, true).setAuthenticationResult(
@@ -242,7 +242,7 @@ public class AddAuthnStatementToAssertionTest extends OpenSAMLInitBaseTestCase {
@Test public void testSuppressedAuthenticatingAuthorities() {
final BrowserSSOProfileConfiguration ssoConfig = new BrowserSSOProfileConfiguration();
ssoConfig.setSuppressAuthenticatingAuthority(true);
- ssoConfig.setSecurityConfiguration(new SecurityConfiguration());
+ ssoConfig.setSecurityConfiguration(new BasicXMLSecurityConfiguration());
prc.getSubcontext(RelyingPartyContext.class).setProfileConfig(ssoConfig);
prc.getSubcontext(AuthenticationContext.class, true).setAuthenticationResult(
diff --git a/idp-testing/src/main/java/net/shibboleth/idp/authn/testing/MockAuthenticationProfileConfiguration.java b/idp-testing/src/main/java/net/shibboleth/idp/authn/testing/MockAuthenticationProfileConfiguration.java
index 94ce23281..cccf9ea02 100644
--- a/idp-testing/src/main/java/net/shibboleth/idp/authn/testing/MockAuthenticationProfileConfiguration.java
+++ b/idp-testing/src/main/java/net/shibboleth/idp/authn/testing/MockAuthenticationProfileConfiguration.java
@@ -33,7 +33,7 @@ import com.google.common.base.Predicates;
import net.shibboleth.idp.authn.config.AuthenticationProfileConfiguration;
import net.shibboleth.idp.profile.config.AbstractProfileConfiguration;
-import net.shibboleth.idp.profile.config.SecurityConfiguration;
+import net.shibboleth.idp.profile.config.BasicXMLSecurityConfiguration;
import net.shibboleth.shared.annotation.constraint.NonNegative;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
@@ -88,7 +88,7 @@ public class MockAuthenticationProfileConfiguration extends AbstractProfileConfi
@Nonnull @NonnullElements final Collection<String> flows,
@Nonnull @NonnullElements final List<String> formats) {
super(id);
- setSecurityConfiguration(new SecurityConfiguration());
+ setSecurityConfiguration(new BasicXMLSecurityConfiguration());
setDefaultAuthenticationMethods(methods);
setAuthenticationFlows(flows);
setNameIDFormatPrecedence(formats);
diff --git a/idp-testing/src/main/java/net/shibboleth/idp/profile/testing/MockProfileConfiguration.java b/idp-testing/src/main/java/net/shibboleth/idp/profile/testing/MockProfileConfiguration.java
index a435c4415..678d1c1d1 100644
--- a/idp-testing/src/main/java/net/shibboleth/idp/profile/testing/MockProfileConfiguration.java
+++ b/idp-testing/src/main/java/net/shibboleth/idp/profile/testing/MockProfileConfiguration.java
@@ -20,8 +20,8 @@ package net.shibboleth.idp.profile.testing;
import javax.annotation.Nonnull;
import net.shibboleth.idp.profile.config.AbstractProfileConfiguration;
+import net.shibboleth.idp.profile.config.BasicSecurityConfiguration;
import net.shibboleth.idp.profile.config.ProfileConfiguration;
-import net.shibboleth.idp.profile.config.SecurityConfiguration;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
/** Mock implementation of {@link ProfileConfiguration}. */
@@ -34,7 +34,7 @@ public class MockProfileConfiguration extends AbstractProfileConfiguration {
*/
public MockProfileConfiguration(@Nonnull @NotEmpty final String id) {
super(id);
- setSecurityConfiguration(new SecurityConfiguration());
+ setSecurityConfiguration(new BasicSecurityConfiguration());
}
}
\ No newline at end of file
diff --git a/idp-testing/src/main/java/net/shibboleth/idp/saml/saml1/profile/testing/SAML1ActionTestingSupport.java b/idp-testing/src/main/java/net/shibboleth/idp/saml/saml1/profile/testing/SAML1ActionTestingSupport.java
index d4d484b2e..6a65c185a 100644
--- a/idp-testing/src/main/java/net/shibboleth/idp/saml/saml1/profile/testing/SAML1ActionTestingSupport.java
+++ b/idp-testing/src/main/java/net/shibboleth/idp/saml/saml1/profile/testing/SAML1ActionTestingSupport.java
@@ -23,6 +23,7 @@ import java.util.Collection;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import net.shibboleth.idp.profile.config.BasicXMLSecurityConfiguration;
import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.config.SecurityConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
@@ -73,7 +74,7 @@ public final class SAML1ActionTestingSupport extends org.opensaml.saml.saml1.tes
rpConfig.setProfileConfigurations(buildProfileConfigurations());
rpConfig.initialize();
- RelyingPartyContext subcontext = parent.getSubcontext(RelyingPartyContext.class, true);
+ final RelyingPartyContext subcontext = parent.getSubcontext(RelyingPartyContext.class, true);
subcontext.setRelyingPartyId(id);
subcontext.setProfileConfig(rpConfig.getProfileConfiguration(null, BrowserSSOProfileConfiguration.PROFILE_ID));
subcontext.setConfiguration(rpConfig);
@@ -88,19 +89,19 @@ public final class SAML1ActionTestingSupport extends org.opensaml.saml.saml1.tes
* @return the constructed {@link ProfileConfiguration}
*/
public static Collection<ProfileConfiguration> buildProfileConfigurations() {
- ArrayList<ProfileConfiguration> profileConfigs = new ArrayList<>();
+ final ArrayList<ProfileConfiguration> profileConfigs = new ArrayList<>();
- SecurityConfiguration securityConfig = new SecurityConfiguration();
+ final SecurityConfiguration securityConfig = new BasicXMLSecurityConfiguration();
- ArtifactResolutionProfileConfiguration artifactConfig = new ArtifactResolutionProfileConfiguration();
+ final ArtifactResolutionProfileConfiguration artifactConfig = new ArtifactResolutionProfileConfiguration();
artifactConfig.setSecurityConfiguration(securityConfig);
profileConfigs.add(artifactConfig);
- AttributeQueryProfileConfiguration attributeConfig = new AttributeQueryProfileConfiguration();
+ final AttributeQueryProfileConfiguration attributeConfig = new AttributeQueryProfileConfiguration();
attributeConfig.setSecurityConfiguration(securityConfig);
profileConfigs.add(attributeConfig);
- BrowserSSOProfileConfiguration ssoConfig = new BrowserSSOProfileConfiguration();
+ final BrowserSSOProfileConfiguration ssoConfig = new BrowserSSOProfileConfiguration();
ssoConfig.setSecurityConfiguration(securityConfig);
profileConfigs.add(ssoConfig);
diff --git a/idp-testing/src/main/java/net/shibboleth/idp/saml/saml2/profile/testing/SAML2ActionTestingSupport.java b/idp-testing/src/main/java/net/shibboleth/idp/saml/saml2/profile/testing/SAML2ActionTestingSupport.java
index 6930b9ccc..8284d8612 100644
--- a/idp-testing/src/main/java/net/shibboleth/idp/saml/saml2/profile/testing/SAML2ActionTestingSupport.java
+++ b/idp-testing/src/main/java/net/shibboleth/idp/saml/saml2/profile/testing/SAML2ActionTestingSupport.java
@@ -23,6 +23,7 @@ import java.util.Collection;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import net.shibboleth.idp.profile.config.BasicXMLSecurityConfiguration;
import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.config.SecurityConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
@@ -73,7 +74,7 @@ public final class SAML2ActionTestingSupport extends org.opensaml.saml.saml2.tes
rpConfig.setProfileConfigurations(buildProfileConfigurations());
rpConfig.initialize();
- RelyingPartyContext subcontext = parent.getSubcontext(RelyingPartyContext.class, true);
+ final RelyingPartyContext subcontext = parent.getSubcontext(RelyingPartyContext.class, true);
subcontext.setRelyingPartyId(id);
subcontext.setProfileConfig(rpConfig.getProfileConfiguration(null, BrowserSSOProfileConfiguration.PROFILE_ID));
subcontext.setConfiguration(rpConfig);
@@ -88,19 +89,19 @@ public final class SAML2ActionTestingSupport extends org.opensaml.saml.saml2.tes
* @return the constructed {@link ProfileConfiguration}
*/
public static Collection<ProfileConfiguration> buildProfileConfigurations() {
- ArrayList<ProfileConfiguration> profileConfigs = new ArrayList<>();
+ final ArrayList<ProfileConfiguration> profileConfigs = new ArrayList<>();
- SecurityConfiguration securityConfig = new SecurityConfiguration();
+ final SecurityConfiguration securityConfig = new BasicXMLSecurityConfiguration();
- ArtifactResolutionProfileConfiguration artifactConfig = new ArtifactResolutionProfileConfiguration();
+ final ArtifactResolutionProfileConfiguration artifactConfig = new ArtifactResolutionProfileConfiguration();
artifactConfig.setSecurityConfiguration(securityConfig);
profileConfigs.add(artifactConfig);
- AttributeQueryProfileConfiguration attributeConfig = new AttributeQueryProfileConfiguration();
+ final AttributeQueryProfileConfiguration attributeConfig = new AttributeQueryProfileConfiguration();
attributeConfig.setSecurityConfiguration(securityConfig);
profileConfigs.add(attributeConfig);
- BrowserSSOProfileConfiguration ssoConfig = new BrowserSSOProfileConfiguration();
+ final BrowserSSOProfileConfiguration ssoConfig = new BrowserSSOProfileConfiguration();
ssoConfig.setSecurityConfiguration(securityConfig);
profileConfigs.add(ssoConfig);
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list