[java-opensaml] branch main updated: Move IdP SecurityConfig classes into OpenSAML.
Scott Cantor
cantor.2 at osu.edu
Mon Jan 30 18:59:13 UTC 2023
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-opensaml.
View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=26c4df95e5d1a2a1cdcaa1111b9604a4981d9466
The following commit(s) were added to refs/heads/main by this push:
new 26c4df95e Move IdP SecurityConfig classes into OpenSAML.
26c4df95e is described below
commit 26c4df95e5d1a2a1cdcaa1111b9604a4981d9466
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Jan 30 13:59:10 2023 -0500
Move IdP SecurityConfig classes into OpenSAML.
---
opensaml-security-api/pom.xml | 4 +
.../config/BasicSecurityConfiguration.java | 114 +++++++++++++++++++
.../security/config/SecurityConfiguration.java | 65 +++++++++++
.../config/BasicXMLSecurityConfiguration.java | 126 +++++++++++++++++++++
.../xmlsec/config/XMLSecurityConfiguration.java | 63 +++++++++++
5 files changed, 372 insertions(+)
diff --git a/opensaml-security-api/pom.xml b/opensaml-security-api/pom.xml
index 3ad216ce5..de82f425b 100644
--- a/opensaml-security-api/pom.xml
+++ b/opensaml-security-api/pom.xml
@@ -38,6 +38,10 @@
<groupId>${shib-shared.groupId}</groupId>
<artifactId>shib-networking</artifactId>
</dependency>
+ <dependency>
+ <groupId>${shib-shared.groupId}</groupId>
+ <artifactId>shib-security</artifactId>
+ </dependency>
<dependency>
<groupId>commons-codec</groupId>
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/config/BasicSecurityConfiguration.java b/opensaml-security-api/src/main/java/org/opensaml/security/config/BasicSecurityConfiguration.java
new file mode 100644
index 000000000..4c1f0a90d
--- /dev/null
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/config/BasicSecurityConfiguration.java
@@ -0,0 +1,114 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.opensaml.security.config;
+
+import java.time.Duration;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.security.IdentifierGenerationStrategy;
+import net.shibboleth.shared.security.IdentifierGenerationStrategy.ProviderType;
+
+import org.opensaml.security.httpclient.HttpClientSecurityConfiguration;
+import org.opensaml.security.x509.tls.ClientTLSValidationConfiguration;
+
+/**
+ * Basic implementation of {@link SecurityConfiguration} interface.
+ *
+ * @since 5.0.0
+ */
+public class BasicSecurityConfiguration implements SecurityConfiguration {
+
+ /** Acceptable clock skew. */
+ @Nonnull private final Duration clockSkew;
+
+ /** Generator used to generate various secure IDs (e.g., message identifiers). */
+ @Nonnull private final IdentifierGenerationStrategy idGenerator;
+
+ /** Configuration used when validating client TLS X509Credentials. */
+ @Nullable private ClientTLSValidationConfiguration clientTLSConfig;
+
+ /** Configuration used when executing HttpClient requests. */
+ @Nullable private HttpClientSecurityConfiguration httpClientConfig;
+
+ /**
+ * Constructor.
+ *
+ * Initializes the clock skew to 5 minutes and the identifier generator to {@link ProviderType#SECURE}.
+ */
+ public BasicSecurityConfiguration() {
+ clockSkew = Duration.ofMinutes(5);
+ idGenerator = IdentifierGenerationStrategy.getInstance(ProviderType.SECURE);
+ }
+
+ /**
+ * Constructor.
+ *
+ * @param skew the clock skew, must be greater than 0
+ * @param generator the identifier generator, must not be null
+ */
+ public BasicSecurityConfiguration(@Nonnull final Duration skew,
+ @Nonnull final IdentifierGenerationStrategy generator) {
+ Constraint.isNotNull(skew, "Clock skew cannot be null");
+ Constraint.isFalse(skew.isNegative() || skew.isZero(), "Clock skew must be greater than 0");
+
+ clockSkew = skew;
+ idGenerator = Constraint.isNotNull(generator, "Identifier generator cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public Duration getClockSkew() {
+ return clockSkew;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public IdentifierGenerationStrategy getIdGenerator() {
+ return idGenerator;
+ }
+
+ /** {@inheritDoc} */
+ @Nullable public ClientTLSValidationConfiguration getClientTLSValidationConfiguration() {
+ return clientTLSConfig;
+ }
+
+ /**
+ * Set the configuration used when validating client TLS X509Credentials.
+ *
+ * @param config configuration used when validating client TLS X509Credentials, or null
+ */
+ public void setClientTLSValidationConfiguration(@Nullable final ClientTLSValidationConfiguration config) {
+ clientTLSConfig = config;
+ }
+
+ /** {@inheritDoc} */
+ @Nullable public HttpClientSecurityConfiguration getHttpClientSecurityConfiguration() {
+ return httpClientConfig;
+ }
+
+ /**
+ * Set the configuration used when executing HttpClient requests.
+ *
+ * @param config configuration used when executing HttpClient requests, or null
+ */
+ public void setHttpClientSecurityConfiguration(@Nullable final HttpClientSecurityConfiguration config) {
+ httpClientConfig = config;
+ }
+
+}
\ No newline at end of file
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/config/SecurityConfiguration.java b/opensaml-security-api/src/main/java/org/opensaml/security/config/SecurityConfiguration.java
new file mode 100644
index 000000000..eb732dff4
--- /dev/null
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/config/SecurityConfiguration.java
@@ -0,0 +1,65 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.opensaml.security.config;
+
+import java.time.Duration;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.security.httpclient.HttpClientSecurityConfiguration;
+import org.opensaml.security.x509.tls.ClientTLSValidationConfiguration;
+
+import net.shibboleth.shared.security.IdentifierGenerationStrategy;
+
+/**
+ * General security settings for profiles.
+ *
+ * @since 5.0.0
+ */
+public interface SecurityConfiguration {
+
+ /**
+ * Get the acceptable clock skew.
+ *
+ * @return acceptable clock skew
+ */
+ @Nonnull Duration getClockSkew();
+
+ /**
+ * Get the generator used to generate secure identifiers.
+ *
+ * @return generator used to generate secure identifiers
+ */
+ @Nonnull IdentifierGenerationStrategy getIdGenerator();
+
+ /**
+ * Get the configuration used when validating client TLS X509Credentials.
+ *
+ * @return configuration used when validating client TLS X509Credentials, or null
+ */
+ @Nullable ClientTLSValidationConfiguration getClientTLSValidationConfiguration();
+
+ /**
+ * Get the configuration used when executing HttpClient requests.
+ *
+ * @return configuration used when executing HttpClient requests, or null
+ */
+ @Nullable HttpClientSecurityConfiguration getHttpClientSecurityConfiguration();
+
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/config/BasicXMLSecurityConfiguration.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/config/BasicXMLSecurityConfiguration.java
new file mode 100644
index 000000000..e54a59d59
--- /dev/null
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/config/BasicXMLSecurityConfiguration.java
@@ -0,0 +1,126 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.opensaml.xmlsec.config;
+
+import java.time.Duration;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import net.shibboleth.shared.security.IdentifierGenerationStrategy;
+
+import org.opensaml.security.config.BasicSecurityConfiguration;
+import org.opensaml.xmlsec.DecryptionConfiguration;
+import org.opensaml.xmlsec.EncryptionConfiguration;
+import org.opensaml.xmlsec.SignatureSigningConfiguration;
+import org.opensaml.xmlsec.SignatureValidationConfiguration;
+
+/**
+ * Basic implementation of {@link XMLSecurityConfiguration} interface.
+ *
+ * @since 5.0.0
+ */
+public class BasicXMLSecurityConfiguration extends BasicSecurityConfiguration implements XMLSecurityConfiguration {
+
+ /** Configuration used when validating protocol message signatures. */
+ @Nullable private SignatureValidationConfiguration sigValidateConfig;
+
+ /** Configuration used when generating protocol message signatures. */
+ @Nullable private SignatureSigningConfiguration sigSigningConfig;
+
+ /** Configuration used when decrypting protocol message information. */
+ @Nullable private DecryptionConfiguration decryptConfig;
+
+ /** Configuration used when encrypting protocol message information. */
+ @Nullable private EncryptionConfiguration encryptConfig;
+
+ /**
+ * Default constructor.
+ */
+ public BasicXMLSecurityConfiguration() {
+
+ }
+
+ /**
+ * Constructor.
+ *
+ * @param skew the clock skew, must be greater than 0
+ * @param generator the identifier generator, must not be null
+ */
+ public BasicXMLSecurityConfiguration(@Nonnull final Duration skew,
+ @Nonnull final IdentifierGenerationStrategy generator) {
+ super(skew, generator);
+ }
+
+ /** {@inheritDoc} */
+ @Nullable public SignatureValidationConfiguration getSignatureValidationConfiguration() {
+ return sigValidateConfig;
+ }
+
+ /**
+ * Set the configuration used when validating protocol message signatures.
+ *
+ * @param config configuration used when validating protocol message signatures, or null
+ */
+ public void setSignatureValidationConfiguration(@Nullable final SignatureValidationConfiguration config) {
+ sigValidateConfig = config;
+ }
+
+ /** {@inheritDoc} */
+ @Nullable public SignatureSigningConfiguration getSignatureSigningConfiguration() {
+ return sigSigningConfig;
+ }
+
+ /**
+ * Set the configuration used when generating protocol message signatures.
+ *
+ * @param config configuration used when generating protocol message signatures, or null
+ */
+ public void setSignatureSigningConfiguration(@Nullable final SignatureSigningConfiguration config) {
+ sigSigningConfig = config;
+ }
+
+ /** {@inheritDoc} */
+ @Nullable public DecryptionConfiguration getDecryptionConfiguration() {
+ return decryptConfig;
+ }
+
+ /**
+ * Set the configuration used when decrypting protocol message information.
+ *
+ * @param config configuration used when decrypting protocol message information, or null
+ */
+ public void setDecryptionConfiguration(@Nullable final DecryptionConfiguration config) {
+ decryptConfig = config;
+ }
+
+ /** {@inheritDoc} */
+ @Nullable public EncryptionConfiguration getEncryptionConfiguration() {
+ return encryptConfig;
+ }
+
+ /**
+ * Set the configuration used when encrypting protocol message information.
+ *
+ * @param config configuration used when encrypting protocol message information, or null
+ */
+ public void setEncryptionConfiguration(@Nullable final EncryptionConfiguration config) {
+ encryptConfig = config;
+ }
+
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/config/XMLSecurityConfiguration.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/config/XMLSecurityConfiguration.java
new file mode 100644
index 000000000..0182d17c8
--- /dev/null
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/config/XMLSecurityConfiguration.java
@@ -0,0 +1,63 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.opensaml.xmlsec.config;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.security.config.SecurityConfiguration;
+import org.opensaml.xmlsec.DecryptionConfiguration;
+import org.opensaml.xmlsec.EncryptionConfiguration;
+import org.opensaml.xmlsec.SignatureSigningConfiguration;
+import org.opensaml.xmlsec.SignatureValidationConfiguration;
+
+/**
+ * Extends base interface with XML Security configuration objects.
+ *
+ * @since 5.0.0
+ */
+public interface XMLSecurityConfiguration extends SecurityConfiguration {
+
+ /**
+ * Get the configuration used when validating protocol message signatures.
+ *
+ * @return configuration used when validating protocol message signatures, or null
+ */
+ @Nullable SignatureValidationConfiguration getSignatureValidationConfiguration();
+
+ /**
+ * Get the configuration used when generating protocol message signatures.
+ *
+ * @return configuration used when generating protocol message signatures, or null
+ */
+ @Nullable SignatureSigningConfiguration getSignatureSigningConfiguration();
+
+ /**
+ * Get the configuration used when decrypting protocol message information.
+ *
+ * @return configuration used when decrypting protocol message information, or null
+ */
+ @Nullable DecryptionConfiguration getDecryptionConfiguration();
+
+ /**
+ * Get the configuration used when encrypting protocol message information.
+ *
+ * @return configuration used when encrypting protocol message information, or null
+ */
+ @Nullable EncryptionConfiguration getEncryptionConfiguration();
+
+}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list