[java-shib-metadata] 01/02: OSJ-391: Default supported TLS protocols appears too broad
Brent Putman
putmanb at georgetown.edu
Fri Feb 9 15:59:36 UTC 2024
This is an automated email from the git hooks/post-receive script.
putmanb pushed a commit to branch main
in repository java-shib-metadata.
View the commit online:
http://git.shibboleth.net/view/?p=java-shib-metadata.git;a=commit;h=32e1110f3095938f566b5028af7c65d790acf69e
commit 32e1110f3095938f566b5028af7c65d790acf69e
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Thu Feb 1 03:52:49 2024 -0500
OSJ-391: Default supported TLS protocols appears too broad
Add unit test examples which illustrate use of standard Spring beans
file elements alongside custom schema, particularly for wiring up
HttpClientSecurityParameters for use with an HTTP metadata resolver.
---
.../DynamicHTTPMetadataProviderParserTest.java | 36 ++++++++++
.../FileBackedHTTPMetadataProviderParserTest.java | 22 ++++++
.../spring/metadata/beans-httpClientSecParams.xml | 62 +++++++++++++++++
...Engine-explicitKey-params-ref-same-document.xml | 79 ++++++++++++++++++++++
...ic-https-trustEngine-explicitKey-params-ref.xml | 17 +++++
...Engine-explicitKey-params-ref-same-document.xml | 75 ++++++++++++++++++++
.../https-trustEngine-explicitKey-params-ref.xml | 15 ++++
7 files changed, 306 insertions(+)
diff --git a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/DynamicHTTPMetadataProviderParserTest.java b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/DynamicHTTPMetadataProviderParserTest.java
index 5aee82f3..543fd7da 100644
--- a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/DynamicHTTPMetadataProviderParserTest.java
+++ b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/DynamicHTTPMetadataProviderParserTest.java
@@ -403,6 +403,42 @@ public class DynamicHTTPMetadataProviderParserTest extends AbstractMetadataParse
Assert.assertEquals(ed.getEntityID(), entityID);
}
+ @Test
+ public void testHTTPSTrustEngineExplicitKeyViaParamsRef() throws Exception {
+ MockPropertySource propSource = singletonPropertySource(PROP_MDURL,
+ RepositorySupport.buildHTTPSResourceURL(REPO_OPENSAML, TEMPLATE_URL));
+
+ final FunctionDrivenDynamicHTTPMetadataResolver resolver = getBean(FunctionDrivenDynamicHTTPMetadataResolver.class,
+ propSource, "dynamic-https-trustEngine-explicitKey-params-ref.xml", "beans.xml", "beans-httpClientSecParams.xml");
+
+ final String entityID = "https://www.example.org/sp";
+
+ final CriteriaSet criteriaSet = new CriteriaSet( new EntityIdCriterion(entityID));
+
+ final EntityDescriptor ed = resolver.resolveSingle(criteriaSet);
+ Assert.assertNotNull(ed);
+ assert ed != null;
+ Assert.assertEquals(ed.getEntityID(), entityID);
+ }
+
+ @Test
+ public void testHTTPSTrustEngineExplicitKeyViaParamsRefSameDocument() throws Exception {
+ MockPropertySource propSource = singletonPropertySource(PROP_MDURL,
+ RepositorySupport.buildHTTPSResourceURL(REPO_OPENSAML, TEMPLATE_URL));
+
+ final FunctionDrivenDynamicHTTPMetadataResolver resolver = getBean(FunctionDrivenDynamicHTTPMetadataResolver.class,
+ propSource, "dynamic-https-trustEngine-explicitKey-params-ref-same-document.xml", "beans.xml");
+
+ final String entityID = "https://www.example.org/sp";
+
+ final CriteriaSet criteriaSet = new CriteriaSet( new EntityIdCriterion(entityID));
+
+ final EntityDescriptor ed = resolver.resolveSingle(criteriaSet);
+ Assert.assertNotNull(ed);
+ assert ed != null;
+ Assert.assertEquals(ed.getEntityID(), entityID);
+ }
+
@Test
public void testHTTPSTrustEngineInvalidKey() throws Exception {
MockPropertySource propSource = singletonPropertySource(PROP_MDURL,
diff --git a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/FileBackedHTTPMetadataProviderParserTest.java b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/FileBackedHTTPMetadataProviderParserTest.java
index d9671980..93411d2c 100644
--- a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/FileBackedHTTPMetadataProviderParserTest.java
+++ b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/FileBackedHTTPMetadataProviderParserTest.java
@@ -171,6 +171,28 @@ public class FileBackedHTTPMetadataProviderParserTest extends AbstractMetadataPa
assertNotNull(resolver.resolveSingle(criteriaFor(IDP_ID)));
}
+ @Test public void httpsTrustEngineExplicitKeyViaParamsRef() throws Exception {
+ MockPropertySource propSource = singletonPropertySource(PROP_MDURL,
+ RepositorySupport.buildHTTPSResourceURL(REPO_IDP, ENTITY_XML));
+
+ HTTPMetadataResolver resolver = getBean(HTTPMetadataResolver.class, propSource, "https-trustEngine-explicitKey-params-ref.xml", "beans.xml", "beans-httpClientSecParams.xml");
+
+ assertEquals(resolver.getId(), "HTTPSEntity");
+
+ assertNotNull(resolver.resolveSingle(criteriaFor(IDP_ID)));
+ }
+
+ @Test public void httpsTrustEngineExplicitKeyViaParamsRefSameDocument() throws Exception {
+ MockPropertySource propSource = singletonPropertySource(PROP_MDURL,
+ RepositorySupport.buildHTTPSResourceURL(REPO_IDP, ENTITY_XML));
+
+ HTTPMetadataResolver resolver = getBean(HTTPMetadataResolver.class, propSource, "https-trustEngine-explicitKey-params-ref-same-document.xml", "beans.xml");
+
+ assertEquals(resolver.getId(), "HTTPSEntity");
+
+ assertNotNull(resolver.resolveSingle(criteriaFor(IDP_ID)));
+ }
+
@Test(expectedExceptions=BeanCreationException.class) public void httpsTrustEngineInvalidKey() throws Exception {
MockPropertySource propSource = singletonPropertySource(PROP_MDURL,
RepositorySupport.buildHTTPSResourceURL(REPO_IDP, ENTITY_XML));
diff --git a/shib-metadata-spring/src/test/resources/net/shibboleth/spring/metadata/beans-httpClientSecParams.xml b/shib-metadata-spring/src/test/resources/net/shibboleth/spring/metadata/beans-httpClientSecParams.xml
new file mode 100644
index 00000000..cbbf8a9a
--- /dev/null
+++ b/shib-metadata-spring/src/test/resources/net/shibboleth/spring/metadata/beans-httpClientSecParams.xml
@@ -0,0 +1,62 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:context="http://www.springframework.org/schema/context"
+ xmlns:util="http://www.springframework.org/schema/util" xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:c="http://www.springframework.org/schema/c" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:security="urn:mace:shibboleth:2.0:security"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd
+ urn:mace:shibboleth:2.0:security http://shibboleth.net/schema/idp/shibboleth-security.xsd"
+
+ default-init-method="initialize" default-destroy-method="destroy" default-lazy-init="true">
+
+ <bean id="metadata.HttpClientSecurityParametersWithTrustEngine" destroy-method=""
+ class="org.opensaml.security.httpclient.HttpClientSecurityParameters">
+ <property name="TLSTrustEngine">
+ <security:TrustEngine id="trustEngine" xsi:type="security:StaticExplicitKey">
+ <security:Credential xsi:type="security:X509Inline">
+ <security:Certificate>
+<!-- The projects LLSS cert -->
+MIIGazCCBFOgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwaTELMAkGA1UEBhMCVVMx
+DTALBgNVBAgMBE9oaW8xHjAcBgNVBAoMFVNoaWJib2xldGggQ29uc29ydGl1bTEr
+MCkGA1UEAwwiU2hpYmJvbGV0aCBQcm9qZWN0IEludGVybWVkaWF0ZSBDQTAeFw0x
+ODEyMTExNTE5NDlaFw0zODEyMDYxNTE5NDlaMFoxCzAJBgNVBAYTAlVTMQ0wCwYD
+VQQIDARPaGlvMR4wHAYDVQQKDBVTaGliYm9sZXRoIENvbnNvcnRpdW0xHDAaBgNV
+BAMME3Rlc3Quc2hpYmJvbGV0aC5uZXQwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAw
+ggIKAoICAQDI39TBFEbOkf0Bb2h/qnG4bbJRF5Ga9OBgSAxPsx2PNgVmf1cvJYlq
+uRCzATu3O4PPclomow5VU7hB+umpk2s03FHejUtO8w85qQx7bkSeyfLpMYloX3SD
+AWDFSpw54Tg2Dfja6jYLnE0aYWUCTXjcFJEIrT0QP1Azdk8b9PeKLqGIagECUMzC
+UjmJxEcyqhbe6mB7tdSsBng+R4DRdVdouN4rtHknNuEyAc5eEppGxY33KXhElYol
+4IK6YxAqXI6iQIDdcVxrH061/iKh7qT1bCAEmzeeoS4st4v4oyIhxUk7yUxYOuFc
+NhYUd5U93Ws4P8xPFzcPhD2TIZDAS/bnm2EJ+JxLG6Gp1jhBN5qTpdTPWiG9+Tmm
+HFuYOrSefgZk0edkJhe0dycfV/FWFX2fNrmkpQhyPQzb3ZyZ5mACn020TXDaF5o3
+fX8ndLl4RghTORJs5n51TuLX85DEeZWkJe5f8Hsip1mpmxlMTl9QMqHrN70n5gBi
+uCYo9g/Jw5xoropCq7Jri9K9FWtbORncUIXutsTVo+fXeHZ6IDRoovR004gHHEJ7
+ks46fZQYNbd8bB/mPlCdYiFyJnfUiOu89O5aLqvhrJNgPUhMt/gmhSV7zw+/3/cd
+o7pwWH2h2ObuS8v8gVUZAE04tefqRJZEB0YsWA3DASDT7nVqndOp2QIDAQABo4IB
+KjCCASYwCQYDVR0TBAIwADARBglghkgBhvhCAQEEBAMCBkAwMwYJYIZIAYb4QgEN
+BCYWJE9wZW5TU0wgR2VuZXJhdGVkIFNlcnZlciBDZXJ0aWZpY2F0ZTAdBgNVHQ4E
+FgQUG3Vg4ubsJVaylBUCPtqVc9mHWfYwgYwGA1UdIwSBhDCBgYAUELzfpij2mkrs
+9B4CEsXYmoN6cKuhZaRjMGExCzAJBgNVBAYTAlVTMQ0wCwYDVQQIDARPaGlvMR4w
+HAYDVQQKDBVTaGliYm9sZXRoIENvbnNvcnRpdW0xIzAhBgNVBAMMGlNoaWJib2xl
+dGggUHJvamVjdCBUZXN0IENBggIQADAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAww
+CgYIKwYBBQUHAwEwDQYJKoZIhvcNAQELBQADggIBAFZQF7KzKGSPieV2eQWbFt30
+kVZzVe/T5UAvrr8n7mRqMfye4QtHHOVM3MHvZv93AXVUQU4PH9KPGtv7poEtwNWk
+7hNbq74z5x5tSvE0EYYI9UMolDL6il+QR5AgLw7YqgMmPPhtm+crmLg8+uMoQDyU
+uSH8ej4rMrdhL2xKlgvL/rhWycpYu1cFLmeolljOZGqr7ITwWJ06BQsLtt4/cyYj
+WiVldHQRZMGAuHLHlX+ukaEg7Gc/N7o936bS5d7AqXwtmtkXiA8An5q5rhncEK1G
+kwUUQN2y5iyx/nD4B2k1IcgFlu/bM4iXZQtmMUtLptUqRssuxS45ukiweiM9UU8n
+WxyxJMzFTctJJ2f/y4Bg5ggsr4WQU/YhoDaQVYxyjXiBt3oT+7eqsoep9HK9xwbG
+xriLzrlao+K3EcKA3vjKGYh15gpEDUbn0Cr5V74TUSdkHjhG7ocaJ5u9/vCS4+AR
+iU5ge2zN6QcwoZKT8+8XGKeXqVc/3hXeXTn3FyvMitPDZsmg8wUhnb/pq5MyKqUA
+bNse4a7oGAeAUGkLf4Q+eLCLSZmL5udrGXdHIffFYqZVcZS+zVWQ1TRfodTDPkFb
+KTz1mcr4KjLNCtplu4CfFpHwC20uk3hPEslOUd+ugj0+HGNH93L7H0WL1GDQoCPh
+RcdRISVwORcD/dit15zD
+ </security:Certificate>
+ </security:Credential>
+ </security:TrustEngine>
+ </property>
+ </bean>
+
+</beans>
\ No newline at end of file
diff --git a/shib-metadata-spring/src/test/resources/net/shibboleth/spring/metadata/dynamic-https-trustEngine-explicitKey-params-ref-same-document.xml b/shib-metadata-spring/src/test/resources/net/shibboleth/spring/metadata/dynamic-https-trustEngine-explicitKey-params-ref-same-document.xml
new file mode 100644
index 00000000..82b16010
--- /dev/null
+++ b/shib-metadata-spring/src/test/resources/net/shibboleth/spring/metadata/dynamic-https-trustEngine-explicitKey-params-ref-same-document.xml
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:context="http://www.springframework.org/schema/context"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:c="http://www.springframework.org/schema/c"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:metadata="urn:mace:shibboleth:2.0:metadata"
+ xmlns:security="urn:mace:shibboleth:2.0:security"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd
+ urn:mace:shibboleth:2.0:security http://shibboleth.net/schema/idp/shibboleth-security.xsd
+ urn:mace:shibboleth:2.0:metadata http://shibboleth.net/schema/idp/shibboleth-metadata.xsd"
+
+ default-init-method="initialize" default-destroy-method="destroy" default-lazy-init="true">
+
+ <metadata:MetadataProvider
+ id="dynamicHttpsTrustEngineExplicitKey"
+ xsi:type="metadata:DynamicHTTPMetadataProvider"
+ httpClientSecurityParametersRef="metadata.HttpClientSecurityParametersWithTrustEngine">
+
+ <!-- Note: use of the transformRef here is mostly just to facilitate testing. -->
+ <metadata:Template transformRef="digester.SHA1HexLower">
+ %{metadataURL}
+ </metadata:Template>
+
+ </metadata:MetadataProvider>
+
+ <bean id="metadata.HttpClientSecurityParametersWithTrustEngine" destroy-method=""
+ class="org.opensaml.security.httpclient.HttpClientSecurityParameters">
+ <property name="TLSTrustEngine">
+ <security:TrustEngine id="trustEngine" xsi:type="security:StaticExplicitKey">
+ <security:Credential xsi:type="security:X509Inline">
+ <security:Certificate>
+<!-- The projects LLSS cert -->
+MIIGazCCBFOgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwaTELMAkGA1UEBhMCVVMx
+DTALBgNVBAgMBE9oaW8xHjAcBgNVBAoMFVNoaWJib2xldGggQ29uc29ydGl1bTEr
+MCkGA1UEAwwiU2hpYmJvbGV0aCBQcm9qZWN0IEludGVybWVkaWF0ZSBDQTAeFw0x
+ODEyMTExNTE5NDlaFw0zODEyMDYxNTE5NDlaMFoxCzAJBgNVBAYTAlVTMQ0wCwYD
+VQQIDARPaGlvMR4wHAYDVQQKDBVTaGliYm9sZXRoIENvbnNvcnRpdW0xHDAaBgNV
+BAMME3Rlc3Quc2hpYmJvbGV0aC5uZXQwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAw
+ggIKAoICAQDI39TBFEbOkf0Bb2h/qnG4bbJRF5Ga9OBgSAxPsx2PNgVmf1cvJYlq
+uRCzATu3O4PPclomow5VU7hB+umpk2s03FHejUtO8w85qQx7bkSeyfLpMYloX3SD
+AWDFSpw54Tg2Dfja6jYLnE0aYWUCTXjcFJEIrT0QP1Azdk8b9PeKLqGIagECUMzC
+UjmJxEcyqhbe6mB7tdSsBng+R4DRdVdouN4rtHknNuEyAc5eEppGxY33KXhElYol
+4IK6YxAqXI6iQIDdcVxrH061/iKh7qT1bCAEmzeeoS4st4v4oyIhxUk7yUxYOuFc
+NhYUd5U93Ws4P8xPFzcPhD2TIZDAS/bnm2EJ+JxLG6Gp1jhBN5qTpdTPWiG9+Tmm
+HFuYOrSefgZk0edkJhe0dycfV/FWFX2fNrmkpQhyPQzb3ZyZ5mACn020TXDaF5o3
+fX8ndLl4RghTORJs5n51TuLX85DEeZWkJe5f8Hsip1mpmxlMTl9QMqHrN70n5gBi
+uCYo9g/Jw5xoropCq7Jri9K9FWtbORncUIXutsTVo+fXeHZ6IDRoovR004gHHEJ7
+ks46fZQYNbd8bB/mPlCdYiFyJnfUiOu89O5aLqvhrJNgPUhMt/gmhSV7zw+/3/cd
+o7pwWH2h2ObuS8v8gVUZAE04tefqRJZEB0YsWA3DASDT7nVqndOp2QIDAQABo4IB
+KjCCASYwCQYDVR0TBAIwADARBglghkgBhvhCAQEEBAMCBkAwMwYJYIZIAYb4QgEN
+BCYWJE9wZW5TU0wgR2VuZXJhdGVkIFNlcnZlciBDZXJ0aWZpY2F0ZTAdBgNVHQ4E
+FgQUG3Vg4ubsJVaylBUCPtqVc9mHWfYwgYwGA1UdIwSBhDCBgYAUELzfpij2mkrs
+9B4CEsXYmoN6cKuhZaRjMGExCzAJBgNVBAYTAlVTMQ0wCwYDVQQIDARPaGlvMR4w
+HAYDVQQKDBVTaGliYm9sZXRoIENvbnNvcnRpdW0xIzAhBgNVBAMMGlNoaWJib2xl
+dGggUHJvamVjdCBUZXN0IENBggIQADAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAww
+CgYIKwYBBQUHAwEwDQYJKoZIhvcNAQELBQADggIBAFZQF7KzKGSPieV2eQWbFt30
+kVZzVe/T5UAvrr8n7mRqMfye4QtHHOVM3MHvZv93AXVUQU4PH9KPGtv7poEtwNWk
+7hNbq74z5x5tSvE0EYYI9UMolDL6il+QR5AgLw7YqgMmPPhtm+crmLg8+uMoQDyU
+uSH8ej4rMrdhL2xKlgvL/rhWycpYu1cFLmeolljOZGqr7ITwWJ06BQsLtt4/cyYj
+WiVldHQRZMGAuHLHlX+ukaEg7Gc/N7o936bS5d7AqXwtmtkXiA8An5q5rhncEK1G
+kwUUQN2y5iyx/nD4B2k1IcgFlu/bM4iXZQtmMUtLptUqRssuxS45ukiweiM9UU8n
+WxyxJMzFTctJJ2f/y4Bg5ggsr4WQU/YhoDaQVYxyjXiBt3oT+7eqsoep9HK9xwbG
+xriLzrlao+K3EcKA3vjKGYh15gpEDUbn0Cr5V74TUSdkHjhG7ocaJ5u9/vCS4+AR
+iU5ge2zN6QcwoZKT8+8XGKeXqVc/3hXeXTn3FyvMitPDZsmg8wUhnb/pq5MyKqUA
+bNse4a7oGAeAUGkLf4Q+eLCLSZmL5udrGXdHIffFYqZVcZS+zVWQ1TRfodTDPkFb
+KTz1mcr4KjLNCtplu4CfFpHwC20uk3hPEslOUd+ugj0+HGNH93L7H0WL1GDQoCPh
+RcdRISVwORcD/dit15zD
+ </security:Certificate>
+ </security:Credential>
+ </security:TrustEngine>
+ </property>
+ </bean>
+
+</beans>
+
\ No newline at end of file
diff --git a/shib-metadata-spring/src/test/resources/net/shibboleth/spring/metadata/dynamic-https-trustEngine-explicitKey-params-ref.xml b/shib-metadata-spring/src/test/resources/net/shibboleth/spring/metadata/dynamic-https-trustEngine-explicitKey-params-ref.xml
new file mode 100644
index 00000000..0705d16e
--- /dev/null
+++ b/shib-metadata-spring/src/test/resources/net/shibboleth/spring/metadata/dynamic-https-trustEngine-explicitKey-params-ref.xml
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<metadata:MetadataProvider xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
+ xmlns:metadata="urn:mace:shibboleth:2.0:metadata"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="urn:mace:shibboleth:2.0:metadata http://shibboleth.net/schema/idp/shibboleth-metadata.xsd
+ urn:oasis:names:tc:SAML:2.0:metadata http://docs.oasis-open.org/security/saml/v2.0/saml-schema-metadata-2.0.xsd"
+
+ id="dynamicHttpsTrustEngineExplicitKey" xsi:type="metadata:DynamicHTTPMetadataProvider"
+ httpClientSecurityParametersRef="metadata.HttpClientSecurityParametersWithTrustEngine">
+
+ <!-- Note: use of the transformRef here is mostly just to facilitate testing. -->
+ <metadata:Template transformRef="digester.SHA1HexLower">
+ %{metadataURL}
+ </metadata:Template>
+
+</metadata:MetadataProvider>
+
\ No newline at end of file
diff --git a/shib-metadata-spring/src/test/resources/net/shibboleth/spring/metadata/https-trustEngine-explicitKey-params-ref-same-document.xml b/shib-metadata-spring/src/test/resources/net/shibboleth/spring/metadata/https-trustEngine-explicitKey-params-ref-same-document.xml
new file mode 100644
index 00000000..6f697c2f
--- /dev/null
+++ b/shib-metadata-spring/src/test/resources/net/shibboleth/spring/metadata/https-trustEngine-explicitKey-params-ref-same-document.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:context="http://www.springframework.org/schema/context"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:c="http://www.springframework.org/schema/c"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:metadata="urn:mace:shibboleth:2.0:metadata"
+ xmlns:security="urn:mace:shibboleth:2.0:security"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd
+ urn:mace:shibboleth:2.0:security http://shibboleth.net/schema/idp/shibboleth-security.xsd
+ urn:mace:shibboleth:2.0:metadata http://shibboleth.net/schema/idp/shibboleth-metadata.xsd"
+
+ default-init-method="initialize" default-destroy-method="destroy" default-lazy-init="true">
+
+ <metadata:MetadataProvider
+ id="HTTPSEntity"
+ xsi:type="metadata:FileBackedHTTPMetadataProvider"
+ httpClientSecurityParametersRef="metadata.HttpClientSecurityParametersWithTrustEngine"
+ backingFile="%{DIR}/spoolhttpstrustengineexplicitkeyviaparams-samedocument.xml"
+ metadataURL="%{metadataURL}">
+ </metadata:MetadataProvider>
+
+ <bean id="metadata.HttpClientSecurityParametersWithTrustEngine" destroy-method=""
+ class="org.opensaml.security.httpclient.HttpClientSecurityParameters">
+ <property name="TLSTrustEngine">
+ <security:TrustEngine id="trustEngine" xsi:type="security:StaticExplicitKey">
+ <security:Credential xsi:type="security:X509Inline">
+ <security:Certificate>
+<!-- The projects LLSS cert -->
+MIIGazCCBFOgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwaTELMAkGA1UEBhMCVVMx
+DTALBgNVBAgMBE9oaW8xHjAcBgNVBAoMFVNoaWJib2xldGggQ29uc29ydGl1bTEr
+MCkGA1UEAwwiU2hpYmJvbGV0aCBQcm9qZWN0IEludGVybWVkaWF0ZSBDQTAeFw0x
+ODEyMTExNTE5NDlaFw0zODEyMDYxNTE5NDlaMFoxCzAJBgNVBAYTAlVTMQ0wCwYD
+VQQIDARPaGlvMR4wHAYDVQQKDBVTaGliYm9sZXRoIENvbnNvcnRpdW0xHDAaBgNV
+BAMME3Rlc3Quc2hpYmJvbGV0aC5uZXQwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAw
+ggIKAoICAQDI39TBFEbOkf0Bb2h/qnG4bbJRF5Ga9OBgSAxPsx2PNgVmf1cvJYlq
+uRCzATu3O4PPclomow5VU7hB+umpk2s03FHejUtO8w85qQx7bkSeyfLpMYloX3SD
+AWDFSpw54Tg2Dfja6jYLnE0aYWUCTXjcFJEIrT0QP1Azdk8b9PeKLqGIagECUMzC
+UjmJxEcyqhbe6mB7tdSsBng+R4DRdVdouN4rtHknNuEyAc5eEppGxY33KXhElYol
+4IK6YxAqXI6iQIDdcVxrH061/iKh7qT1bCAEmzeeoS4st4v4oyIhxUk7yUxYOuFc
+NhYUd5U93Ws4P8xPFzcPhD2TIZDAS/bnm2EJ+JxLG6Gp1jhBN5qTpdTPWiG9+Tmm
+HFuYOrSefgZk0edkJhe0dycfV/FWFX2fNrmkpQhyPQzb3ZyZ5mACn020TXDaF5o3
+fX8ndLl4RghTORJs5n51TuLX85DEeZWkJe5f8Hsip1mpmxlMTl9QMqHrN70n5gBi
+uCYo9g/Jw5xoropCq7Jri9K9FWtbORncUIXutsTVo+fXeHZ6IDRoovR004gHHEJ7
+ks46fZQYNbd8bB/mPlCdYiFyJnfUiOu89O5aLqvhrJNgPUhMt/gmhSV7zw+/3/cd
+o7pwWH2h2ObuS8v8gVUZAE04tefqRJZEB0YsWA3DASDT7nVqndOp2QIDAQABo4IB
+KjCCASYwCQYDVR0TBAIwADARBglghkgBhvhCAQEEBAMCBkAwMwYJYIZIAYb4QgEN
+BCYWJE9wZW5TU0wgR2VuZXJhdGVkIFNlcnZlciBDZXJ0aWZpY2F0ZTAdBgNVHQ4E
+FgQUG3Vg4ubsJVaylBUCPtqVc9mHWfYwgYwGA1UdIwSBhDCBgYAUELzfpij2mkrs
+9B4CEsXYmoN6cKuhZaRjMGExCzAJBgNVBAYTAlVTMQ0wCwYDVQQIDARPaGlvMR4w
+HAYDVQQKDBVTaGliYm9sZXRoIENvbnNvcnRpdW0xIzAhBgNVBAMMGlNoaWJib2xl
+dGggUHJvamVjdCBUZXN0IENBggIQADAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAww
+CgYIKwYBBQUHAwEwDQYJKoZIhvcNAQELBQADggIBAFZQF7KzKGSPieV2eQWbFt30
+kVZzVe/T5UAvrr8n7mRqMfye4QtHHOVM3MHvZv93AXVUQU4PH9KPGtv7poEtwNWk
+7hNbq74z5x5tSvE0EYYI9UMolDL6il+QR5AgLw7YqgMmPPhtm+crmLg8+uMoQDyU
+uSH8ej4rMrdhL2xKlgvL/rhWycpYu1cFLmeolljOZGqr7ITwWJ06BQsLtt4/cyYj
+WiVldHQRZMGAuHLHlX+ukaEg7Gc/N7o936bS5d7AqXwtmtkXiA8An5q5rhncEK1G
+kwUUQN2y5iyx/nD4B2k1IcgFlu/bM4iXZQtmMUtLptUqRssuxS45ukiweiM9UU8n
+WxyxJMzFTctJJ2f/y4Bg5ggsr4WQU/YhoDaQVYxyjXiBt3oT+7eqsoep9HK9xwbG
+xriLzrlao+K3EcKA3vjKGYh15gpEDUbn0Cr5V74TUSdkHjhG7ocaJ5u9/vCS4+AR
+iU5ge2zN6QcwoZKT8+8XGKeXqVc/3hXeXTn3FyvMitPDZsmg8wUhnb/pq5MyKqUA
+bNse4a7oGAeAUGkLf4Q+eLCLSZmL5udrGXdHIffFYqZVcZS+zVWQ1TRfodTDPkFb
+KTz1mcr4KjLNCtplu4CfFpHwC20uk3hPEslOUd+ugj0+HGNH93L7H0WL1GDQoCPh
+RcdRISVwORcD/dit15zD
+ </security:Certificate>
+ </security:Credential>
+ </security:TrustEngine>
+ </property>
+ </bean>
+
+</beans>
+
\ No newline at end of file
diff --git a/shib-metadata-spring/src/test/resources/net/shibboleth/spring/metadata/https-trustEngine-explicitKey-params-ref.xml b/shib-metadata-spring/src/test/resources/net/shibboleth/spring/metadata/https-trustEngine-explicitKey-params-ref.xml
new file mode 100644
index 00000000..8bc074df
--- /dev/null
+++ b/shib-metadata-spring/src/test/resources/net/shibboleth/spring/metadata/https-trustEngine-explicitKey-params-ref.xml
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<metadata:MetadataProvider xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:metadata="urn:mace:shibboleth:2.0:metadata"
+ xsi:schemaLocation="urn:mace:shibboleth:2.0:metadata http://shibboleth.net/schema/idp/shibboleth-metadata.xsd
+ urn:oasis:names:tc:SAML:2.0:metadata http://docs.oasis-open.org/security/saml/v2.0/saml-schema-metadata-2.0.xsd"
+
+ id="HTTPSEntity"
+ xsi:type="metadata:FileBackedHTTPMetadataProvider"
+ httpClientSecurityParametersRef="metadata.HttpClientSecurityParametersWithTrustEngine"
+ backingFile="%{DIR}/spoolhttpstrustengineexplicitkeyviaparams.xml"
+ metadataURL="%{metadataURL}">
+
+</metadata:MetadataProvider>
+
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list