[java-identity-provider] 09/09: IDP-2117 Make the plugin Installer understand HttpClientSecurityParameters
Rod Widdowson
rdw at steadingsoftware.com
Tue May 23 08:23:17 UTC 2023
This is an automated email from the git hooks/post-receive script.
rdw pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=4f4e51583363ad4214b24e9603f652742d559980
commit 4f4e51583363ad4214b24e9603f652742d559980
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Mon May 22 19:47:31 2023 +0100
IDP-2117 Make the plugin Installer understand HttpClientSecurityParameters
https://shibboleth.atlassian.net/browse/IDP-2117
---
.../shibboleth/idp/installer/impl/V5Install.java | 1 +
.../idp/installer/plugin/impl/PluginInstaller.java | 10 +++++--
.../installer/plugin/impl/PluginInstallerCLI.java | 12 ++++++--
.../idp/installer/plugin/impl/PluginState.java | 33 +++++++++++++++++++++-
4 files changed, 51 insertions(+), 5 deletions(-)
diff --git a/idp-installer/src/main/java/net/shibboleth/idp/installer/impl/V5Install.java b/idp-installer/src/main/java/net/shibboleth/idp/installer/impl/V5Install.java
index 1f4eaedce..6a6f45df6 100644
--- a/idp-installer/src/main/java/net/shibboleth/idp/installer/impl/V5Install.java
+++ b/idp-installer/src/main/java/net/shibboleth/idp/installer/impl/V5Install.java
@@ -141,6 +141,7 @@ public class V5Install {
log.debug("Considering Plugin {}, version {}", pluginId, pluginVersion);
final PluginState state = new PluginState(plugin, CollectionSupport.emptyList());
state.setHttpClient(httpClient);
+ state.setHttpClientSecurityParameters(httpClientSecurityParameters);
state.initialize();
if (!state.getPluginInfo().isSupportedWithIdPVersion(pluginVersion, idpVersion)) {
log.warn("Installed Plugin {} version {} is not supported with IdP Version {}, continuing.",
diff --git a/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/PluginInstaller.java b/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/PluginInstaller.java
index 41c148704..17e61b6ac 100644
--- a/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/PluginInstaller.java
+++ b/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/PluginInstaller.java
@@ -61,6 +61,7 @@ import org.apache.commons.compress.compressors.gzip.GzipCompressorInputStream;
import org.apache.commons.compress.utils.IOUtils;
import org.apache.hc.client5.http.classic.HttpClient;
import org.apache.tools.ant.BuildException;
+import org.opensaml.security.httpclient.HttpClientSecurityContextHandler;
import org.opensaml.security.httpclient.HttpClientSecurityParameters;
import org.slf4j.Logger;
@@ -291,6 +292,7 @@ public final class PluginInstaller extends AbstractInitializableComponent implem
if (checkVersion) {
final PluginState state = new PluginState(getDescription(), updateOverrideURLs);
state.setHttpClient(httpClient);
+ state.setHttpClientSecurityParameters(securityParams);
try {
state.initialize();
} catch (final ComponentInitializationException e) {
@@ -672,10 +674,14 @@ public final class PluginInstaller extends AbstractInitializableComponent implem
private void download(@Nonnull final URL baseURL, @Nonnull final String fileName) throws BuildException {
try {
downloadDirectory = Files.createTempDirectory("plugin-installer-download");
- final Resource baseResource = new HTTPResource(httpClient, baseURL);
+ final HTTPResource baseResource = new HTTPResource(httpClient, baseURL);
+ final HttpClientSecurityContextHandler handler = new HttpClientSecurityContextHandler();
+ handler.setHttpClientSecurityParameters(securityParams);
+ handler.initialize();
+ baseResource.setHttpClientContextHandler(handler);
download(baseResource, fileName);
download(baseResource, fileName + ".asc");
- } catch (final IOException e) {
+ } catch (final IOException | ComponentInitializationException e) {
LOG.error("Error in download", e);
throw new BuildException(e);
}
diff --git a/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/PluginInstallerCLI.java b/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/PluginInstallerCLI.java
index 3d8ba16e3..12df2d90a 100644
--- a/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/PluginInstallerCLI.java
+++ b/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/PluginInstallerCLI.java
@@ -40,6 +40,7 @@ import javax.annotation.Nullable;
import org.apache.hc.client5.http.classic.HttpClient;
import org.apache.tools.ant.BuildException;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
+import org.opensaml.security.httpclient.HttpClientSecurityContextHandler;
import org.slf4j.Logger;
import org.springframework.beans.BeansException;
import org.springframework.core.io.ClassPathResource;
@@ -260,6 +261,7 @@ public final class PluginInstallerCLI extends AbstractIdPHomeAwareCommandLine<Pl
final HttpClient client = getHttpClient();
if (client != null) {
state.setHttpClient(client);
+ state.setHttpClientSecurityParameters(getHttpClientSecurityParameters());
}
try {
state.initialize();
@@ -467,7 +469,12 @@ public final class PluginInstallerCLI extends AbstractIdPHomeAwareCommandLine<Pl
} else if ("http".equals(url.getProtocol()) || "https".equals(url.getProtocol())) {
final HttpClient client = getHttpClient();
assert client != null;
- propertyResource = new HTTPResource(client , url);
+ final HTTPResource httpResource;
+ propertyResource = httpResource = new HTTPResource(client , url);
+ final HttpClientSecurityContextHandler handler = new HttpClientSecurityContextHandler();
+ handler.setHttpClientSecurityParameters(getHttpClientSecurityParameters());
+ handler.initialize();
+ httpResource.setHttpClientContextHandler(handler);
} else {
log.error("Only file and http[s] URLs are allowed");
continue;
@@ -479,7 +486,7 @@ public final class PluginInstallerCLI extends AbstractIdPHomeAwareCommandLine<Pl
}
props.load(propertyResource.getInputStream());
return props;
- } catch (final IOException e) {
+ } catch (final IOException | ComponentInitializationException e) {
log.error("Could not open Update URL {} :", url, e);
continue;
}
@@ -586,6 +593,7 @@ public final class PluginInstallerCLI extends AbstractIdPHomeAwareCommandLine<Pl
final HttpClient client = getHttpClient();
if (client != null) {
state.setHttpClient(client);
+ state.setHttpClientSecurityParameters(getHttpClientSecurityParameters());
}
try {
state.initialize();
diff --git a/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/PluginState.java b/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/PluginState.java
index d0150518d..f21384c32 100644
--- a/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/PluginState.java
+++ b/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/PluginState.java
@@ -23,8 +23,11 @@ import java.util.List;
import java.util.Properties;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import org.apache.hc.client5.http.classic.HttpClient;
+import org.opensaml.security.httpclient.HttpClientSecurityContextHandler;
+import org.opensaml.security.httpclient.HttpClientSecurityParameters;
import org.slf4j.Logger;
import org.springframework.core.io.FileSystemResource;
import org.springframework.core.io.Resource;
@@ -61,6 +64,9 @@ public class PluginState extends AbstractInitializableComponent {
/** The HttpClient to use.*/
@NonnullAfterInit private HttpClient httpClient;
+ /** The Injected security parameters. */
+ @Nullable private HttpClientSecurityParameters httpClientSecurityParameters;
+
/** If overridden these are the urls to us for update (rather than what the plguin asks for. */
@Nonnull private final List<URL> updateOverrideURLs;
@@ -104,6 +110,7 @@ public class PluginState extends AbstractInitializableComponent {
}
/** Set the client.
+ *
* @param what what to set.
*/
public void setHttpClient(@Nonnull final HttpClient what) {
@@ -111,6 +118,25 @@ public class PluginState extends AbstractInitializableComponent {
httpClient = Constraint.isNotNull(what, "HttpClient cannot be null");
}
+ /** Gets {@link HttpClient} security parameters, if any.
+ *
+ * @return HTTP client security parameters to use
+ */
+ @Nullable public HttpClientSecurityParameters getHttpClientSecurityParameters() {
+ return httpClientSecurityParameters;
+ }
+
+ /**
+ * Sets {@link HttpClient} security parameters to use.
+ *
+ * @param params security parameters
+ */
+ public void setHttpClientSecurityParameters(@Nullable final HttpClientSecurityParameters params) {
+ httpClientSecurityParameters = params;
+ }
+
+ /**
+
/** {@inheritDoc} */
// CheckStyle: CyclomaticComplexity OFF
@SuppressWarnings("unused")
@@ -138,8 +164,13 @@ public class PluginState extends AbstractInitializableComponent {
assert path != null;
propertyResource = new FileSystemResource(path);
} else if ("http".equals(url.getProtocol()) || "https".equals(url.getProtocol())) {
+ final HTTPResource httpResource;
assert(httpClient != null);
- propertyResource = new HTTPResource(httpClient, url);
+ propertyResource = httpResource = new HTTPResource(httpClient, url);
+ final HttpClientSecurityContextHandler handler = new HttpClientSecurityContextHandler();
+ handler.setHttpClientSecurityParameters(httpClientSecurityParameters);
+ handler.initialize();
+ httpResource.setHttpClientContextHandler(handler);
} else {
log.error("Plugin {}: Only file and http[s] URLs are allowed: '{}'", plugin.getPluginId(), url);
continue;
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list