[java-idp-testbed] branch main updated: Remove unnecessary keys and certs for attribute query and logout
Tom Zeller
tzeller at dragonacea.biz
Mon Jul 1 21:35:19 UTC 2024
This is an automated email from the git hooks/post-receive script.
tzeller pushed a commit to branch main
in repository java-idp-testbed.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-testbed.git;a=commit;h=4f129710f931760b54aa1d27020a5f3a340ec341
The following commit(s) were added to refs/heads/main by this push:
new 4f12971 Remove unnecessary keys and certs for attribute query and logout
4f12971 is described below
commit 4f129710f931760b54aa1d27020a5f3a340ec341
Author: Tom Zeller <tzeller at dragonacea.biz>
AuthorDate: Mon Jul 1 16:34:26 2024 -0500
Remove unnecessary keys and certs for attribute query and logout
Use a trust-any HTTP client instead.
---
src/main/java/sp/SAML1Controller.java | 78 ++++++-------------------------
src/main/java/sp/SAML2Controller.java | 87 ++++++-----------------------------
src/main/webapp/index.html | 66 ++------------------------
3 files changed, 30 insertions(+), 201 deletions(-)
diff --git a/src/main/java/sp/SAML1Controller.java b/src/main/java/sp/SAML1Controller.java
index 411b0db..bd205ec 100644
--- a/src/main/java/sp/SAML1Controller.java
+++ b/src/main/java/sp/SAML1Controller.java
@@ -15,18 +15,17 @@
package sp;
import java.io.IOException;
-import java.security.KeyStore;
import java.security.PrivateKey;
-import java.security.cert.Certificate;
import java.security.cert.X509Certificate;
import java.time.Instant;
import java.util.Map;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
-import javax.net.ssl.SSLContext;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
+import net.shibboleth.shared.httpclient.HttpClientBuilder;
+import net.shibboleth.shared.httpclient.HttpClientSupport;
import net.shibboleth.shared.primitive.StringSupport;
import net.shibboleth.shared.security.IdentifierGenerationStrategy;
import net.shibboleth.shared.security.IdentifierGenerationStrategy.ProviderType;
@@ -34,14 +33,6 @@ import net.shibboleth.shared.xml.SerializeSupport;
import net.shibboleth.shared.xml.XMLParserException;
import org.apache.hc.client5.http.classic.HttpClient;
-import org.apache.hc.client5.http.impl.classic.CloseableHttpClient;
-import org.apache.hc.client5.http.impl.classic.HttpClients;
-import org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManager;
-import org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManagerBuilder;
-import org.apache.hc.client5.http.ssl.SSLConnectionSocketFactory;
-import org.apache.hc.client5.http.ssl.SSLConnectionSocketFactoryBuilder;
-import org.apache.hc.core5.ssl.SSLContextBuilder;
-import org.apache.hc.core5.ssl.SSLContexts;
import org.cryptacular.util.CertUtil;
import org.cryptacular.util.KeyPairUtil;
import org.opensaml.core.xml.XMLObject;
@@ -158,29 +149,11 @@ public class SAML1Controller extends BaseSAMLController {
initSAML1AttributeQuery(HttpServletRequest servletRequest, HttpServletResponse servletResponse,
@RequestParam(value = "endpoint", required = true) String endpoint,
@RequestParam(value = "principalName", required = true) String principalName,
- @RequestParam(value = "trustedTLSCertificate", required = true) String trustedTLSCertificate,
- @RequestParam(value = "trustedTLSCertificatePassword", required = true) String trustedTLSCertificatePassword,
- @RequestParam(value = "clientTLSCertificate", required = false) String clientTLSCertificate,
- @RequestParam(value = "clientTLSPrivateKey", required = true) String clientTLSPrivateKey,
- @RequestParam(value = "clientTLSPassword", required = true) String clientTLSPassword,
@RequestParam(value = "clientSigningCertificate", required = false) String clientSigningCertificate,
@RequestParam(value = "clientSigningPrivateKey", required = false) String clientSigningPrivateKey)
throws Exception {
- final Resource trustedTLSCertificateResource = applicationContext.getResource(trustedTLSCertificate);
- log.debug("Trusted TLS certificate resource '{}'", trustedTLSCertificateResource);
-
- Resource clientTLSCertificateResource = null;
- if (StringSupport.trimOrNull(clientTLSCertificate) != null) {
- clientTLSCertificateResource = applicationContext.getResource(clientTLSCertificate);
- }
- log.debug("Client TLS certificate resource '{}'", clientTLSCertificateResource);
-
- final Resource clientTLSPrivateKeyResource = applicationContext.getResource(clientTLSPrivateKey);
- log.debug("Client TLS private key resource '{}'", clientTLSPrivateKeyResource);
-
- final HttpClient httpClient = buildHttpClient(trustedTLSCertificateResource, trustedTLSCertificatePassword,
- clientTLSCertificateResource, clientTLSPrivateKeyResource, clientTLSPassword);
+ final HttpClient httpClient = buildHttpClient();
final HttpSOAPClient httpSoapClient = new HttpSOAPClient();
httpSoapClient.setParserPool(parserPool);
@@ -310,41 +283,16 @@ public class SAML1Controller extends BaseSAMLController {
return envelope;
}
- @Nonnull public HttpClient buildHttpClient(@Nonnull final Resource trustedTLSCertificate,
- @Nonnull final String trustedTLSCertificatePassword, @Nullable final Resource clientTLSCertificate,
- @Nonnull final Resource clientTLSPrivateKey, @Nonnull final String clientTLSPassword) throws Exception {
-
- final KeyStore trustStore = KeyStore.getInstance("PKCS12");
- trustStore.load(trustedTLSCertificate.getInputStream(), trustedTLSCertificatePassword.toCharArray());
-
- final PrivateKey clientPrivateKey = KeyPairUtil.readPrivateKey(clientTLSPrivateKey.getInputStream());
-
- X509Certificate clientCert = null;
- if (clientTLSCertificate != null) {
- clientCert = CertUtil.readCertificate(clientTLSCertificate.getInputStream());
- }
-
- final KeyStore keyStore = KeyStore.getInstance("JKS");
- keyStore.load(null, null);
- keyStore.setKeyEntry("sp", clientPrivateKey, clientTLSPassword.toCharArray(), new Certificate[] {clientCert});
-
- final SSLContextBuilder sslContextBuilder = SSLContexts.custom();
- sslContextBuilder.loadTrustMaterial(trustStore, null);
- sslContextBuilder.loadKeyMaterial(keyStore, clientTLSPassword.toCharArray());
-
- final SSLContext sslcontext = sslContextBuilder.build();
-
- final SSLConnectionSocketFactory sslSocketFactory = SSLConnectionSocketFactoryBuilder.create()
- .setSslContext(sslcontext)
- .build();
-
- final PoolingHttpClientConnectionManager connMgr = PoolingHttpClientConnectionManagerBuilder.create()
- .setSSLSocketFactory(sslSocketFactory)
- .build();
-
- final CloseableHttpClient httpClient = HttpClients.custom().setConnectionManager(connMgr).build();
-
- return httpClient;
+ /**
+ * Build a {@link HttpClient} which accepts all peer certificates and performs
+ * no hostname verification.
+ *
+ * @return the http client
+ */
+ @Nonnull public HttpClient buildHttpClient() throws Exception {
+ final HttpClientBuilder builder = new HttpClientBuilder();
+ builder.setTLSSocketFactory(HttpClientSupport.buildNoTrustTLSSocketFactory());
+ return builder.buildClient();
}
public void sign(@Nonnull final SignableXMLObject signable, @Nonnull final String certificate,
diff --git a/src/main/java/sp/SAML2Controller.java b/src/main/java/sp/SAML2Controller.java
index b5594bd..33163fc 100644
--- a/src/main/java/sp/SAML2Controller.java
+++ b/src/main/java/sp/SAML2Controller.java
@@ -112,6 +112,8 @@ import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.component.ComponentInitializationException;
+import net.shibboleth.shared.httpclient.HttpClientBuilder;
+import net.shibboleth.shared.httpclient.HttpClientSupport;
import net.shibboleth.shared.net.URLBuilder;
import net.shibboleth.shared.primitive.NonnullSupplier;
import net.shibboleth.shared.primitive.StringSupport;
@@ -867,29 +869,11 @@ public class SAML2Controller extends BaseSAMLController {
initSAML2LogoutRequest(final HttpServletRequest servletRequest, final HttpServletResponse servletResponse,
@RequestParam(value = "endpoint", required = true) final String endpoint,
@RequestParam(value = "principalName", required = true) final String principalName,
- @RequestParam(value = "trustedTLSCertificate", required = true) final String trustedTLSCertificate,
- @RequestParam(value = "trustedTLSCertificatePassword", required = true) final String trustedTLSCertificatePassword,
- @RequestParam(value = "clientTLSCertificate", required = false) final String clientTLSCertificate,
- @RequestParam(value = "clientTLSPrivateKey", required = true) final String clientTLSPrivateKey,
- @RequestParam(value = "clientTLSPassword", required = true) final String clientTLSPassword,
@RequestParam(value = "clientSigningCertificate", required = false) final String clientSigningCertificate,
@RequestParam(value = "clientSigningPrivateKey", required = false) final String clientSigningPrivateKey)
throws Exception {
- final Resource trustedTLSCertificateResource = applicationContext.getResource(trustedTLSCertificate);
- log.debug("Trusted TLS certificate resource '{}'", trustedTLSCertificateResource);
-
- Resource clientTLSCertificateResource = null;
- if (StringSupport.trimOrNull(clientTLSCertificate) != null) {
- clientTLSCertificateResource = applicationContext.getResource(clientTLSCertificate);
- }
- log.debug("Client TLS certificate resource '{}'", clientTLSCertificateResource);
-
- final Resource clientTLSPrivateKeyResource = applicationContext.getResource(clientTLSPrivateKey);
- log.debug("Client TLS private key resource '{}'", clientTLSPrivateKeyResource);
-
- final HttpClient httpClient = buildHttpClient(trustedTLSCertificateResource, trustedTLSCertificatePassword,
- clientTLSCertificateResource, clientTLSPrivateKeyResource, clientTLSPassword);
+ final HttpClient httpClient = buildHttpClient();
final HttpSOAPClient httpSoapClient = new HttpSOAPClient();
httpSoapClient.setParserPool(parserPool);
@@ -947,29 +931,11 @@ public class SAML2Controller extends BaseSAMLController {
initSAML2AttributeQuery(final HttpServletRequest servletRequest, final HttpServletResponse servletResponse,
@RequestParam(value = "endpoint", required = true) final String endpoint,
@RequestParam(value = "principalName", required = true) final String principalName,
- @RequestParam(value = "trustedTLSCertificate", required = true) final String trustedTLSCertificate,
- @RequestParam(value = "trustedTLSCertificatePassword", required = true) final String trustedTLSCertificatePassword,
- @RequestParam(value = "clientTLSCertificate", required = false) final String clientTLSCertificate,
- @RequestParam(value = "clientTLSPrivateKey", required = true) final String clientTLSPrivateKey,
- @RequestParam(value = "clientTLSPassword", required = true) final String clientTLSPassword,
@RequestParam(value = "clientSigningCertificate", required = false) final String clientSigningCertificate,
@RequestParam(value = "clientSigningPrivateKey", required = false) final String clientSigningPrivateKey)
throws Exception {
- final Resource trustedTLSCertificateResource = applicationContext.getResource(trustedTLSCertificate);
- log.debug("Trusted TLS certificate resource '{}'", trustedTLSCertificateResource);
-
- Resource clientTLSCertificateResource = null;
- if (StringSupport.trimOrNull(clientTLSCertificate) != null) {
- clientTLSCertificateResource = applicationContext.getResource(clientTLSCertificate);
- }
- log.debug("Client TLS certificate resource '{}'", clientTLSCertificateResource);
-
- final Resource clientTLSPrivateKeyResource = applicationContext.getResource(clientTLSPrivateKey);
- log.debug("Client TLS private key resource '{}'", clientTLSPrivateKeyResource);
-
- final HttpClient httpClient = buildHttpClient(trustedTLSCertificateResource, trustedTLSCertificatePassword,
- clientTLSCertificateResource, clientTLSPrivateKeyResource, clientTLSPassword);
+ final HttpClient httpClient = buildHttpClient();
final HttpSOAPClient httpSoapClient = new HttpSOAPClient();
httpSoapClient.setParserPool(parserPool);
@@ -1139,41 +1105,16 @@ public class SAML2Controller extends BaseSAMLController {
return inOutOpCtx;
}
- @Nonnull public HttpClient buildHttpClient(@Nonnull final Resource trustedTLSCertificate,
- @Nonnull final String trustedTLSCertificatePassword, @Nullable final Resource clientTLSCertificate,
- @Nonnull final Resource clientTLSPrivateKey, @Nonnull final String clientTLSPassword) throws Exception {
-
- final KeyStore trustStore = KeyStore.getInstance("PKCS12");
- trustStore.load(trustedTLSCertificate.getInputStream(), trustedTLSCertificatePassword.toCharArray());
-
- final PrivateKey clientPrivateKey = KeyPairUtil.readPrivateKey(clientTLSPrivateKey.getInputStream());
-
- X509Certificate clientCert = null;
- if (clientTLSCertificate != null) {
- clientCert = CertUtil.readCertificate(clientTLSCertificate.getInputStream());
- }
-
- final KeyStore keyStore = KeyStore.getInstance("JKS");
- keyStore.load(null, null);
- keyStore.setKeyEntry("sp", clientPrivateKey, clientTLSPassword.toCharArray(), new Certificate[] {clientCert});
-
- final SSLContextBuilder sslContextBuilder = SSLContexts.custom();
- sslContextBuilder.loadTrustMaterial(trustStore, null);
- sslContextBuilder.loadKeyMaterial(keyStore, clientTLSPassword.toCharArray());
-
- final SSLContext sslcontext = sslContextBuilder.build();
-
- final SSLConnectionSocketFactory sslSocketFactory = SSLConnectionSocketFactoryBuilder.create()
- .setSslContext(sslcontext)
- .build();
-
- final PoolingHttpClientConnectionManager connMgr = PoolingHttpClientConnectionManagerBuilder.create()
- .setSSLSocketFactory(sslSocketFactory)
- .build();
-
- final CloseableHttpClient httpClient = HttpClients.custom().setConnectionManager(connMgr).build();
-
- return httpClient;
+ /**
+ * Build a {@link HttpClient} which accepts all peer certificates and performs
+ * no hostname verification.
+ *
+ * @return the http client
+ */
+ @Nonnull public HttpClient buildHttpClient() throws Exception {
+ final HttpClientBuilder builder = new HttpClientBuilder();
+ builder.setTLSSocketFactory(HttpClientSupport.buildNoTrustTLSSocketFactory());
+ return builder.buildClient();
}
public void sign(@Nonnull final SignableXMLObject signable, @Nonnull final String certificate,
diff --git a/src/main/webapp/index.html b/src/main/webapp/index.html
index 5ae2bc4..3bda4cf 100644
--- a/src/main/webapp/index.html
+++ b/src/main/webapp/index.html
@@ -210,32 +210,12 @@
<table>
<tr>
<td>endpoint</td>
- <td><input id="saml2-soap-logout-endpoint" name="endpoint" value="https://localhost:9443/idp/profile/SAML2/SOAP/SLO" size="60" /></td>
+ <td><input id="saml2-soap-logout-endpoint" name="endpoint" value="https://localhost/idp/profile/SAML2/SOAP/SLO" size="60" /></td>
</tr>
<tr>
<td>principalName</td>
<td><input id="saml2-soap-logout-principalName" name="principalName" value="jdoe" /></td>
</tr>
- <tr>
- <td>trustedTLSCertificate</td>
- <td><input id="saml2-soap-logout-trustedTLSCertificate" name="trustedTLSCertificate" value="classpath:/credentials/idp-backchannel.p12" size="90" /></td>
- </tr>
- <tr>
- <td>trustedTLSCertificatePassword</td>
- <td><input id="saml2-soap-logout-trustedTLSCertificatePassword" name="trustedTLSCertificatePassword" value="changeit" size="20" /></td>
- </tr>
- <tr>
- <td>clientTLSCertificate</td>
- <td><input id="saml2-soap-logout-clientTLSCertificate" name="clientTLSCertificate" value="classpath:/credentials/sp.crt" size="90" /></td>
- </tr>
- <tr>
- <td>clientTLSPrivateKey</td>
- <td><input id="saml2-soap-logout-clientTLSPrivateKey" name="clientTLSPrivateKey" value="classpath:/credentials/sp.key" size="90" /></td>
- </tr>
- <tr>
- <td>clientTLSPassword</td>
- <td><input id="saml2-soap-logout-clientTLSPassword" name="clientTLSPassword" value="secret" size="20" /></td>
- </tr>
<tr>
<td>clientSigningCertificate</td>
<td><input id="saml2-soap-logout-clientSigningCertificate" name="clientSigningCertificate" value="classpath:/credentials/sp.crt" size="90" /></td>
@@ -253,32 +233,12 @@
<table>
<tr>
<td>endpoint</td>
- <td><input id="saml2-attribute-query-endpoint" name="endpoint" value="https://localhost:9443/idp/profile/SAML2/SOAP/AttributeQuery" size="60" /></td>
+ <td><input id="saml2-attribute-query-endpoint" name="endpoint" value="https://localhost/idp/profile/SAML2/SOAP/AttributeQuery" size="60" /></td>
</tr>
<tr>
<td>principalName</td>
<td><input id="saml2-attribute-query-principalName" name="principalName" value="jdoe" /></td>
</tr>
- <tr>
- <td>trustedTLSCertificate</td>
- <td><input id="saml2-attribute-query-trustedTLSCertificate" name="trustedTLSCertificate" value="classpath:/credentials/idp-backchannel.p12" size="90" /></td>
- </tr>
- <tr>
- <td>trustedTLSCertificatePassword</td>
- <td><input id="saml2-attribute-query-trustedTLSCertificatePassword" name="trustedTLSCertificatePassword" value="changeit" size="20" /></td>
- </tr>
- <tr>
- <td>clientTLSCertificate</td>
- <td><input id="saml2-attribute-query-clientTLSCertificate" name="clientTLSCertificate" value="classpath:/credentials/sp.crt" size="90" /></td>
- </tr>
- <tr>
- <td>clientTLSPrivateKey</td>
- <td><input id="saml2-attribute-query-clientTLSPrivateKey" name="clientTLSPrivateKey" value="classpath:/credentials/sp.key" size="90" /></td>
- </tr>
- <tr>
- <td>clientTLSPassword</td>
- <td><input id="saml2-attribute-query-clientTLSPassword" name="clientTLSPassword" value="secret" size="20" /></td>
- </tr>
<tr>
<td>clientSigningCertificate</td>
<td><input id="saml2-attribute-query-clientSigningCertificate" name="clientSigningCertificate" value="classpath:/credentials/sp.crt" size="90" /></td>
@@ -296,32 +256,12 @@
<table>
<tr>
<td>endpoint</td>
- <td><input id="saml1-attribute-query-endpoint" name="endpoint" value="https://localhost:9443/idp/profile/SAML1/SOAP/AttributeQuery" size="60" /></td>
+ <td><input id="saml1-attribute-query-endpoint" name="endpoint" value="https://localhost/idp/profile/SAML1/SOAP/AttributeQuery" size="60" /></td>
</tr>
<tr>
<td>principalName</td>
<td><input id="saml1-attribute-query-principalName" name="principalName" value="jdoe" /></td>
</tr>
- <tr>
- <td>trustedTLSCertificate</td>
- <td><input id="saml1-attribute-query-trustedTLSCertificate" name="trustedTLSCertificate" value="classpath:/credentials/idp-backchannel.p12" size="90" /></td>
- </tr>
- <tr>
- <td>trustedTLSCertificatePassword</td>
- <td><input id="saml1-attribute-query-trustedTLSCertificatePassword" name="trustedTLSCertificatePassword" value="changeit" size="20" /></td>
- </tr>
- <tr>
- <td>clientTLSCertificate</td>
- <td><input id="saml1-attribute-query-clientTLSCertificate" name="clientTLSCertificate" value="classpath:/credentials/sp.crt" size="90" /></td>
- </tr>
- <tr>
- <td>clientTLSPrivateKey</td>
- <td><input id="saml1-attribute-query-clientTLSPrivateKey" name="clientTLSPrivateKey" value="classpath:/credentials/sp.key" size="90" /></td>
- </tr>
- <tr>
- <td>clientTLSPassword</td>
- <td><input id="saml1-attribute-query-clientTLSPassword" name="clientTLSPassword" value="secret" size="20" /></td>
- </tr>
<tr>
<td>clientSigningCertificate</td>
<td><input id="saml1-attribute-query-clientSigningCertificate" name="clientSigningCertificate" value="classpath:/credentials/sp.crt" size="90" /></td>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list