[java-identity-provider] branch maint-4 updated: IDP-2007 - Review configuration for direct use of API classes in beans
Scott Cantor
cantor.2 at osu.edu
Tue Jan 3 17:05:04 UTC 2023
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch maint-4
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=d06733753fd06e317e736060b2ce7bb4e07dd318
The following commit(s) were added to refs/heads/maint-4 by this push:
new d06733753 IDP-2007 - Review configuration for direct use of API classes in beans
d06733753 is described below
commit d06733753fd06e317e736060b2ce7bb4e07dd318
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Jan 3 12:05:01 2023 -0500
IDP-2007 - Review configuration for direct use of API classes in beans
https://shibboleth.atlassian.net/browse/IDP-2007
---
.../main/resources/net/shibboleth/idp/conf/conditions.xml | 10 ++++++++++
.../resources/net/shibboleth/idp/conf/security-system.xml | 14 ++++++++++++++
.../net/shibboleth/idp/module/conf/admin/unlock-keys.xml | 2 +-
.../conf/intercept/context-check-intercept-config.xml | 2 +-
.../conf/intercept/expiring-password-intercept-config.xml | 2 +-
idp-conf/src/main/resources/conf/access-control.xml | 2 +-
idp-conf/src/main/resources/conf/credentials.xml | 9 +++------
idp-conf/src/test/resources/conf/credentials.xml | 9 +++------
8 files changed, 34 insertions(+), 16 deletions(-)
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/conditions.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/conditions.xml
index 2188aa290..702fb52fb 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/conditions.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/conditions.xml
@@ -51,6 +51,16 @@
class="net.shibboleth.utilities.java.support.logic.StrategyIndirectedPredicate"
c:objectStrategy-ref="shibboleth.EntityDescriptorLookup.RelyingParty" />
+ <!-- IdPAttribute conditions. -->
+ <bean id="shibboleth.Conditions.SimpleAttribute"
+ class="net.shibboleth.idp.profile.logic.SimpleAttributePredicate" abstract="true" />
+ <bean id="shibboleth.Conditions.DynamicAttribute"
+ class="net.shibboleth.idp.profile.logic.DynamicAttributePredicate" abstract="true" />
+ <bean id="shibboleth.Conditions.RegexAttribute"
+ class="net.shibboleth.idp.profile.logic.RegexAttributePredicate" abstract="true" />
+ <bean id="shibboleth.Conditions.DateAttribute"
+ class="net.shibboleth.idp.profile.logic.DateAttributePredicate" abstract="true" />
+
<!-- Parent bean for building predicates acting over a candidate c14n Subject based on proxy authn. -->
<bean id="shibboleth.Conditions.ProxyAuthentication" abstract="true"
class="net.shibboleth.utilities.java.support.logic.StrategyIndirectedPredicate">
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/security-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/security-system.xml
index efb7f9e06..06991dfb5 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/security-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/security-system.xml
@@ -15,6 +15,20 @@
<bean id="shibboleth.DefaultIdentifierGenerationStrategy"
class="net.shibboleth.utilities.java.support.security.impl.SecureRandomIdentifierGenerationStrategy" />
+ <!-- Credential factory beans, mostly for relying-party service. -->
+
+ <bean id="shibboleth.BasicX509CredentialFactoryBean" abstract="true"
+ class="net.shibboleth.idp.profile.spring.factory.BasicX509CredentialFactoryBean" />
+
+ <bean id="shibboleth.X509InlineCredentialFactoryBean" abstract="true"
+ class="net.shibboleth.idp.profile.spring.factory.X509InlineCredentialFactoryBean" />
+
+ <bean id="shibboleth.BasicResourceCredentialFactoryBean" abstract="true"
+ class="net.shibboleth.idp.profile.spring.factory.BasicResourceCredentialFactoryBean" />
+
+ <bean id="shibboleth.BasicInlineCredentialFactoryBean" abstract="true"
+ class="net.shibboleth.idp.profile.spring.factory.BasicInlineCredentialFactoryBean" />
+
<!-- Principally used in relying-party.xml to define new security configurations. -->
<bean id="shibboleth.BasicSignatureValidationConfiguration" abstract="true"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/admin/unlock-keys.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/admin/unlock-keys.xml
index a639b50bb..c444facd5 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/admin/unlock-keys.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/admin/unlock-keys.xml
@@ -32,7 +32,7 @@
<!-- Uncomment to move the definition of this bean from credentials.xml -->
<!--
<bean id="shibboleth.DefaultSigningCredential"
- class="net.shibboleth.idp.profile.spring.factory.BasicX509CredentialFactoryBean"
+ parent="shibboleth.BasicX509CredentialFactoryBean"
p:certificateResource="%{idp.signing.cert}"
p:entityId="%{idp.entityID}" />
-->
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/intercept/context-check-intercept-config.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/intercept/context-check-intercept-config.xml
index aae07f0f2..60b794320 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/intercept/context-check-intercept-config.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/intercept/context-check-intercept-config.xml
@@ -23,7 +23,7 @@
<constructor-arg>
<list>
<bean parent="shibboleth.Conditions.RelyingPartyId" c:candidates="#{{'https://sp.example.org'}}" />
- <bean class="net.shibboleth.idp.profile.logic.SimpleAttributePredicate"
+ <bean parent="shibboleth.Conditions.SimpleAttribute"
p:useUnfilteredAttributes="true">
<property name="attributeValueMap">
<map>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/intercept/expiring-password-intercept-config.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/intercept/expiring-password-intercept-config.xml
index 55a58dae9..83f95e3eb 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/intercept/expiring-password-intercept-config.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/intercept/expiring-password-intercept-config.xml
@@ -18,7 +18,7 @@
The example uses a built-in class to evaluate an attribute containing a date/time of password expiration.
The format pattern parses the value and the negative offset determines how soon to warn the user beforehand.
-->
- <bean id="shibboleth.expiring-password.Condition" class="net.shibboleth.idp.profile.logic.DateAttributePredicate"
+ <bean id="shibboleth.expiring-password.Condition" parent="shibboleth.Conditions.DateAttribute"
c:attribute="passwordExpiration" c:formatString="yyyyMMddHHmmssX"
p:resultIfMissing="true" p:offset="-P14D" />
diff --git a/idp-conf/src/main/resources/conf/access-control.xml b/idp-conf/src/main/resources/conf/access-control.xml
index 3853722b1..9ed4242ed 100644
--- a/idp-conf/src/main/resources/conf/access-control.xml
+++ b/idp-conf/src/main/resources/conf/access-control.xml
@@ -47,7 +47,7 @@
<entry key="AccessByAttribute">
<bean parent="shibboleth.PredicateAccessControl">
<constructor-arg>
- <bean class="net.shibboleth.idp.profile.logic.SimpleAttributePredicate">
+ <bean parent="shibboleth.Conditions.SimpleAttribute">
<property name="attributeValueMap">
<map>
<entry key="eduPersonEntitlement">
diff --git a/idp-conf/src/main/resources/conf/credentials.xml b/idp-conf/src/main/resources/conf/credentials.xml
index dde530b7f..b40778d35 100644
--- a/idp-conf/src/main/resources/conf/credentials.xml
+++ b/idp-conf/src/main/resources/conf/credentials.xml
@@ -13,8 +13,6 @@
default-destroy-method="destroy">
<!--
- NOTE: if you're using a legacy relying-party.xml file from a V2 configuration, this file is ignored.
-
This defines the signing and encryption key and certificate pairs referenced by your relying-party.xml
configuration. You don't normally need to touch this, unless you have advanced requirements such as
supporting multiple sets of keys for different relying parties, in which case you may want to define
@@ -30,8 +28,7 @@
</util:list>
<!-- Your IdP's default signing key, set via property file. -->
- <bean id="shibboleth.DefaultSigningCredential"
- class="net.shibboleth.idp.profile.spring.factory.BasicX509CredentialFactoryBean"
+ <bean id="shibboleth.DefaultSigningCredential" parent="shibboleth.BasicX509CredentialFactoryBean"
p:privateKeyResource="%{idp.signing.key}"
p:certificateResource="%{idp.signing.cert}"
p:entityId-ref="entityID" />
@@ -48,7 +45,7 @@
<!-- Your IdP's default encryption (really decryption) keys, set via property file. -->
<util:list id="shibboleth.DefaultEncryptionCredentials">
- <bean class="net.shibboleth.idp.profile.spring.factory.BasicX509CredentialFactoryBean"
+ <bean parent="shibboleth.BasicX509CredentialFactoryBean"
p:privateKeyResource="%{idp.encryption.key}"
p:certificateResource="%{idp.encryption.cert}"
p:entityId-ref="entityID" />
@@ -58,7 +55,7 @@
to point to your new keypair. Once metadata has propagated, comment this one out again.
-->
<!--
- <bean class="net.shibboleth.idp.profile.spring.factory.BasicX509CredentialFactoryBean"
+ <bean parent="shibboleth.BasicX509CredentialFactoryBean"
p:privateKeyResource="%{idp.encryption.key.2}"
p:certificateResource="%{idp.encryption.cert.2}"
p:entityId-ref="entityID" />
diff --git a/idp-conf/src/test/resources/conf/credentials.xml b/idp-conf/src/test/resources/conf/credentials.xml
index afb12d854..3bedfdb3c 100644
--- a/idp-conf/src/test/resources/conf/credentials.xml
+++ b/idp-conf/src/test/resources/conf/credentials.xml
@@ -13,8 +13,6 @@
default-destroy-method="destroy">
<!--
- NOTE: if you're using a legacy relying-party.xml file from a V2 configuration, this file is ignored.
-
This defines the signing and encryption key and certificate pairs referenced by your relying-party.xml
configuration. You don't normally need to touch this, unless you have advanced requirements such as
supporting multiple sets of keys for different relying parties, in which case you may want to define
@@ -30,8 +28,7 @@
</util:list>
<!-- Your IdP's default signing key, set via property file. -->
- <bean id="shibboleth.DefaultSigningCredential"
- class="net.shibboleth.idp.profile.spring.factory.BasicX509CredentialFactoryBean"
+ <bean id="shibboleth.DefaultSigningCredential" parent="shibboleth.BasicX509CredentialFactoryBean"
p:privateKeyResource="%{idp.signing.key}"
p:certificateResource="%{idp.signing.cert}"
p:entityId-ref="entityID" />
@@ -48,7 +45,7 @@
<!-- Your IdP's default encryption (really decryption) keys, set via property file. -->
<util:list id="shibboleth.DefaultEncryptionCredentials">
- <bean class="net.shibboleth.idp.profile.spring.factory.BasicX509CredentialFactoryBean"
+ <bean parent="shibboleth.BasicX509CredentialFactoryBean"
p:privateKeyResource="%{idp.encryption.key}"
p:certificateResource="%{idp.encryption.cert}"
p:entityId-ref="entityID" />
@@ -58,7 +55,7 @@
to point to your new keypair. Once metadata has propagated, comment this one out again.
-->
<!--
- <bean class="net.shibboleth.idp.profile.spring.factory.BasicX509CredentialFactoryBean"
+ <bean parent="shibboleth.BasicX509CredentialFactoryBean"
p:privateKeyResource="%{idp.encryption.key.2}"
p:certificateResource="%{idp.encryption.cert.2}"
p:entityId-ref="entityID" />
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list