[java-idp-testbed] branch maint-4 updated: Remove unnecessary keys and certs for attribute query and logout
Tom Zeller
tzeller at dragonacea.biz
Mon Jul 1 21:36:46 UTC 2024
This is an automated email from the git hooks/post-receive script.
tzeller pushed a commit to branch maint-4
in repository java-idp-testbed.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-testbed.git;a=commit;h=ed0b6c4019bd855659edc21e5cac65325a5f560d
The following commit(s) were added to refs/heads/maint-4 by this push:
new ed0b6c4 Remove unnecessary keys and certs for attribute query and logout
ed0b6c4 is described below
commit ed0b6c4019bd855659edc21e5cac65325a5f560d
Author: Tom Zeller <tzeller at dragonacea.biz>
AuthorDate: Mon Jul 1 16:36:38 2024 -0500
Remove unnecessary keys and certs for attribute query and logout
Use a trust-any HTTP client instead.
---
src/main/java/sp/SAML1Controller.java | 66 ++++++--------------------
src/main/java/sp/SAML2Controller.java | 88 ++++++-----------------------------
src/main/webapp/index.html | 66 ++------------------------
3 files changed, 31 insertions(+), 189 deletions(-)
diff --git a/src/main/java/sp/SAML1Controller.java b/src/main/java/sp/SAML1Controller.java
index c52ad02..ffbacac 100644
--- a/src/main/java/sp/SAML1Controller.java
+++ b/src/main/java/sp/SAML1Controller.java
@@ -18,29 +18,24 @@
package sp;
import java.io.IOException;
-import java.security.KeyStore;
import java.security.PrivateKey;
-import java.security.cert.Certificate;
import java.security.cert.X509Certificate;
import java.time.Instant;
import java.util.Map;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
-import javax.net.ssl.SSLContext;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
+import net.shibboleth.utilities.java.support.httpclient.HttpClientBuilder;
+import net.shibboleth.utilities.java.support.httpclient.HttpClientSupport;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
import net.shibboleth.utilities.java.support.security.impl.SecureRandomIdentifierGenerationStrategy;
import net.shibboleth.utilities.java.support.xml.SerializeSupport;
import net.shibboleth.utilities.java.support.xml.XMLParserException;
import org.apache.http.client.HttpClient;
-import org.apache.http.conn.ssl.SSLContextBuilder;
-import org.apache.http.conn.ssl.SSLContexts;
-import org.apache.http.impl.client.CloseableHttpClient;
-import org.apache.http.impl.client.HttpClients;
import org.cryptacular.util.CertUtil;
import org.cryptacular.util.KeyPairUtil;
import org.opensaml.core.xml.XMLObject;
@@ -157,29 +152,11 @@ public class SAML1Controller extends BaseSAMLController {
initSAML1AttributeQuery(HttpServletRequest servletRequest, HttpServletResponse servletResponse,
@RequestParam(value = "endpoint", required = true) String endpoint,
@RequestParam(value = "principalName", required = true) String principalName,
- @RequestParam(value = "trustedTLSCertificate", required = true) String trustedTLSCertificate,
- @RequestParam(value = "trustedTLSCertificatePassword", required = true) String trustedTLSCertificatePassword,
- @RequestParam(value = "clientTLSCertificate", required = false) String clientTLSCertificate,
- @RequestParam(value = "clientTLSPrivateKey", required = true) String clientTLSPrivateKey,
- @RequestParam(value = "clientTLSPassword", required = true) String clientTLSPassword,
@RequestParam(value = "clientSigningCertificate", required = false) String clientSigningCertificate,
@RequestParam(value = "clientSigningPrivateKey", required = false) String clientSigningPrivateKey)
throws Exception {
- final Resource trustedTLSCertificateResource = applicationContext.getResource(trustedTLSCertificate);
- log.debug("Trusted TLS certificate resource '{}'", trustedTLSCertificateResource);
-
- Resource clientTLSCertificateResource = null;
- if (StringSupport.trimOrNull(clientTLSCertificate) != null) {
- clientTLSCertificateResource = applicationContext.getResource(clientTLSCertificate);
- }
- log.debug("Client TLS certificate resource '{}'", clientTLSCertificateResource);
-
- final Resource clientTLSPrivateKeyResource = applicationContext.getResource(clientTLSPrivateKey);
- log.debug("Client TLS private key resource '{}'", clientTLSPrivateKeyResource);
-
- final HttpClient httpClient = buildHttpClient(trustedTLSCertificateResource, trustedTLSCertificatePassword,
- clientTLSCertificateResource, clientTLSPrivateKeyResource, clientTLSPassword);
+ final HttpClient httpClient = buildHttpClient();
final HttpSOAPClient httpSoapClient = new HttpSOAPClient();
httpSoapClient.setParserPool(parserPool);
@@ -309,33 +286,16 @@ public class SAML1Controller extends BaseSAMLController {
return envelope;
}
- @Nonnull public HttpClient buildHttpClient(@Nonnull final Resource trustedTLSCertificate,
- @Nonnull final String trustedTLSCertificatePassword, @Nullable final Resource clientTLSCertificate,
- @Nonnull final Resource clientTLSPrivateKey, @Nonnull final String clientTLSPassword) throws Exception {
-
- final KeyStore trustStore = KeyStore.getInstance("PKCS12");
- trustStore.load(trustedTLSCertificate.getInputStream(), trustedTLSCertificatePassword.toCharArray());
-
- final PrivateKey clientPrivateKey = KeyPairUtil.readPrivateKey(clientTLSPrivateKey.getInputStream());
-
- X509Certificate clientCert = null;
- if (clientTLSCertificate != null) {
- clientCert = CertUtil.readCertificate(clientTLSCertificate.getInputStream());
- }
-
- final KeyStore keyStore = KeyStore.getInstance("JKS");
- keyStore.load(null, null);
- keyStore.setKeyEntry("sp", clientPrivateKey, clientTLSPassword.toCharArray(), new Certificate[] {clientCert});
-
- final SSLContextBuilder sslContextBuilder = SSLContexts.custom();
- sslContextBuilder.loadTrustMaterial(trustStore);
- sslContextBuilder.loadKeyMaterial(keyStore, clientTLSPassword.toCharArray());
-
- final SSLContext sslcontext = sslContextBuilder.build();
-
- final CloseableHttpClient httpClient = HttpClients.custom().setSslcontext(sslcontext).build();
-
- return httpClient;
+ /**
+ * Build a {@link HttpClient} which accepts all peer certificates and performs
+ * no hostname verification.
+ *
+ * @return the http client
+ */
+ @Nonnull public HttpClient buildHttpClient() throws Exception {
+ final HttpClientBuilder builder = new HttpClientBuilder();
+ builder.setTLSSocketFactory(HttpClientSupport.buildNoTrustTLSSocketFactory());
+ return builder.buildClient();
}
public void sign(@Nonnull final SignableXMLObject signable, @Nonnull final String certificate,
diff --git a/src/main/java/sp/SAML2Controller.java b/src/main/java/sp/SAML2Controller.java
index c5909ac..c507504 100644
--- a/src/main/java/sp/SAML2Controller.java
+++ b/src/main/java/sp/SAML2Controller.java
@@ -2,21 +2,20 @@ package sp;
import java.io.IOException;
import java.net.MalformedURLException;
-import java.security.KeyStore;
import java.security.PrivateKey;
-import java.security.cert.Certificate;
import java.security.cert.X509Certificate;
import java.time.Instant;
import java.util.Map;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
-import javax.net.ssl.SSLContext;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
+import net.shibboleth.utilities.java.support.httpclient.HttpClientBuilder;
+import net.shibboleth.utilities.java.support.httpclient.HttpClientSupport;
import net.shibboleth.utilities.java.support.net.URLBuilder;
import net.shibboleth.utilities.java.support.primitive.NonnullSupplier;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
@@ -25,10 +24,6 @@ import net.shibboleth.utilities.java.support.xml.SerializeSupport;
import net.shibboleth.utilities.java.support.xml.XMLParserException;
import org.apache.http.client.HttpClient;
-import org.apache.http.conn.ssl.SSLContextBuilder;
-import org.apache.http.conn.ssl.SSLContexts;
-import org.apache.http.impl.client.CloseableHttpClient;
-import org.apache.http.impl.client.HttpClients;
import org.cryptacular.util.CertUtil;
import org.cryptacular.util.KeyPairUtil;
import org.opensaml.core.xml.XMLObject;
@@ -797,29 +792,11 @@ public class SAML2Controller extends BaseSAMLController {
initSAML2LogoutRequest(HttpServletRequest servletRequest, HttpServletResponse servletResponse,
@RequestParam(value = "endpoint", required = true) String endpoint,
@RequestParam(value = "principalName", required = true) String principalName,
- @RequestParam(value = "trustedTLSCertificate", required = true) String trustedTLSCertificate,
- @RequestParam(value = "trustedTLSCertificatePassword", required = true) String trustedTLSCertificatePassword,
- @RequestParam(value = "clientTLSCertificate", required = false) String clientTLSCertificate,
- @RequestParam(value = "clientTLSPrivateKey", required = true) String clientTLSPrivateKey,
- @RequestParam(value = "clientTLSPassword", required = true) String clientTLSPassword,
@RequestParam(value = "clientSigningCertificate", required = false) String clientSigningCertificate,
@RequestParam(value = "clientSigningPrivateKey", required = false) String clientSigningPrivateKey)
throws Exception {
- final Resource trustedTLSCertificateResource = applicationContext.getResource(trustedTLSCertificate);
- log.debug("Trusted TLS certificate resource '{}'", trustedTLSCertificateResource);
-
- Resource clientTLSCertificateResource = null;
- if (StringSupport.trimOrNull(clientTLSCertificate) != null) {
- clientTLSCertificateResource = applicationContext.getResource(clientTLSCertificate);
- }
- log.debug("Client TLS certificate resource '{}'", clientTLSCertificateResource);
-
- final Resource clientTLSPrivateKeyResource = applicationContext.getResource(clientTLSPrivateKey);
- log.debug("Client TLS private key resource '{}'", clientTLSPrivateKeyResource);
-
- final HttpClient httpClient = buildHttpClient(trustedTLSCertificateResource, trustedTLSCertificatePassword,
- clientTLSCertificateResource, clientTLSPrivateKeyResource, clientTLSPassword);
+ final HttpClient httpClient = buildHttpClient();
final HttpSOAPClient httpSoapClient = new HttpSOAPClient();
httpSoapClient.setParserPool(parserPool);
@@ -852,7 +829,7 @@ public class SAML2Controller extends BaseSAMLController {
headers.add("Content-Type", "text/plain");
return new ResponseEntity<>(formattedMessage, headers, HttpStatus.OK);
- }
+ }
/**
* Send a SAML 2 attribute query.
@@ -877,29 +854,11 @@ public class SAML2Controller extends BaseSAMLController {
initSAML2AttributeQuery(HttpServletRequest servletRequest, HttpServletResponse servletResponse,
@RequestParam(value = "endpoint", required = true) String endpoint,
@RequestParam(value = "principalName", required = true) String principalName,
- @RequestParam(value = "trustedTLSCertificate", required = true) String trustedTLSCertificate,
- @RequestParam(value = "trustedTLSCertificatePassword", required = true) String trustedTLSCertificatePassword,
- @RequestParam(value = "clientTLSCertificate", required = false) String clientTLSCertificate,
- @RequestParam(value = "clientTLSPrivateKey", required = true) String clientTLSPrivateKey,
- @RequestParam(value = "clientTLSPassword", required = true) String clientTLSPassword,
@RequestParam(value = "clientSigningCertificate", required = false) String clientSigningCertificate,
@RequestParam(value = "clientSigningPrivateKey", required = false) String clientSigningPrivateKey)
throws Exception {
- final Resource trustedTLSCertificateResource = applicationContext.getResource(trustedTLSCertificate);
- log.debug("Trusted TLS certificate resource '{}'", trustedTLSCertificateResource);
-
- Resource clientTLSCertificateResource = null;
- if (StringSupport.trimOrNull(clientTLSCertificate) != null) {
- clientTLSCertificateResource = applicationContext.getResource(clientTLSCertificate);
- }
- log.debug("Client TLS certificate resource '{}'", clientTLSCertificateResource);
-
- final Resource clientTLSPrivateKeyResource = applicationContext.getResource(clientTLSPrivateKey);
- log.debug("Client TLS private key resource '{}'", clientTLSPrivateKeyResource);
-
- final HttpClient httpClient = buildHttpClient(trustedTLSCertificateResource, trustedTLSCertificatePassword,
- clientTLSCertificateResource, clientTLSPrivateKeyResource, clientTLSPassword);
+ final HttpClient httpClient = buildHttpClient();
final HttpSOAPClient httpSoapClient = new HttpSOAPClient();
httpSoapClient.setParserPool(parserPool);
@@ -1069,33 +1028,16 @@ public class SAML2Controller extends BaseSAMLController {
return inOutOpCtx;
}
- @Nonnull public HttpClient buildHttpClient(@Nonnull final Resource trustedTLSCertificate,
- @Nonnull final String trustedTLSCertificatePassword, @Nullable final Resource clientTLSCertificate,
- @Nonnull final Resource clientTLSPrivateKey, @Nonnull final String clientTLSPassword) throws Exception {
-
- final KeyStore trustStore = KeyStore.getInstance("PKCS12");
- trustStore.load(trustedTLSCertificate.getInputStream(), trustedTLSCertificatePassword.toCharArray());
-
- final PrivateKey clientPrivateKey = KeyPairUtil.readPrivateKey(clientTLSPrivateKey.getInputStream());
-
- X509Certificate clientCert = null;
- if (clientTLSCertificate != null) {
- clientCert = CertUtil.readCertificate(clientTLSCertificate.getInputStream());
- }
-
- final KeyStore keyStore = KeyStore.getInstance("JKS");
- keyStore.load(null, null);
- keyStore.setKeyEntry("sp", clientPrivateKey, clientTLSPassword.toCharArray(), new Certificate[] {clientCert});
-
- final SSLContextBuilder sslContextBuilder = SSLContexts.custom();
- sslContextBuilder.loadTrustMaterial(trustStore);
- sslContextBuilder.loadKeyMaterial(keyStore, clientTLSPassword.toCharArray());
-
- final SSLContext sslcontext = sslContextBuilder.build();
-
- final CloseableHttpClient httpClient = HttpClients.custom().setSslcontext(sslcontext).build();
-
- return httpClient;
+ /**
+ * Build a {@link HttpClient} which accepts all peer certificates and performs
+ * no hostname verification.
+ *
+ * @return the http client
+ */
+ @Nonnull public HttpClient buildHttpClient() throws Exception {
+ final HttpClientBuilder builder = new HttpClientBuilder();
+ builder.setTLSSocketFactory(HttpClientSupport.buildNoTrustTLSSocketFactory());
+ return builder.buildClient();
}
public void sign(@Nonnull final SignableXMLObject signable, @Nonnull final String certificate,
diff --git a/src/main/webapp/index.html b/src/main/webapp/index.html
index 787074c..fcc14b5 100644
--- a/src/main/webapp/index.html
+++ b/src/main/webapp/index.html
@@ -209,32 +209,12 @@
<table>
<tr>
<td>endpoint</td>
- <td><input id="saml2-soap-logout-endpoint" name="endpoint" value="https://localhost:9443/idp/profile/SAML2/SOAP/SLO" size="60" /></td>
+ <td><input id="saml2-soap-logout-endpoint" name="endpoint" value="https://localhost:8443/idp/profile/SAML2/SOAP/SLO" size="60" /></td>
</tr>
<tr>
<td>principalName</td>
<td><input id="saml2-soap-logout-principalName" name="principalName" value="jdoe" /></td>
</tr>
- <tr>
- <td>trustedTLSCertificate</td>
- <td><input id="saml2-soap-logout-trustedTLSCertificate" name="trustedTLSCertificate" value="classpath:/credentials/idp-backchannel.p12" size="90" /></td>
- </tr>
- <tr>
- <td>trustedTLSCertificatePassword</td>
- <td><input id="saml2-soap-logout-trustedTLSCertificatePassword" name="trustedTLSCertificatePassword" value="changeit" size="20" /></td>
- </tr>
- <tr>
- <td>clientTLSCertificate</td>
- <td><input id="saml2-soap-logout-clientTLSCertificate" name="clientTLSCertificate" value="classpath:/credentials/sp.crt" size="90" /></td>
- </tr>
- <tr>
- <td>clientTLSPrivateKey</td>
- <td><input id="saml2-soap-logout-clientTLSPrivateKey" name="clientTLSPrivateKey" value="classpath:/credentials/sp.key" size="90" /></td>
- </tr>
- <tr>
- <td>clientTLSPassword</td>
- <td><input id="saml2-soap-logout-clientTLSPassword" name="clientTLSPassword" value="secret" size="20" /></td>
- </tr>
<tr>
<td>clientSigningCertificate</td>
<td><input id="saml2-soap-logout-clientSigningCertificate" name="clientSigningCertificate" value="classpath:/credentials/sp.crt" size="90" /></td>
@@ -252,32 +232,12 @@
<table>
<tr>
<td>endpoint</td>
- <td><input id="saml2-attribute-query-endpoint" name="endpoint" value="https://localhost:9443/idp/profile/SAML2/SOAP/AttributeQuery" size="60" /></td>
+ <td><input id="saml2-attribute-query-endpoint" name="endpoint" value="https://localhost:8443/idp/profile/SAML2/SOAP/AttributeQuery" size="60" /></td>
</tr>
<tr>
<td>principalName</td>
<td><input id="saml2-attribute-query-principalName" name="principalName" value="jdoe" /></td>
</tr>
- <tr>
- <td>trustedTLSCertificate</td>
- <td><input id="saml2-attribute-query-trustedTLSCertificate" name="trustedTLSCertificate" value="classpath:/credentials/idp-backchannel.p12" size="90" /></td>
- </tr>
- <tr>
- <td>trustedTLSCertificatePassword</td>
- <td><input id="saml2-attribute-query-trustedTLSCertificatePassword" name="trustedTLSCertificatePassword" value="changeit" size="20" /></td>
- </tr>
- <tr>
- <td>clientTLSCertificate</td>
- <td><input id="saml2-attribute-query-clientTLSCertificate" name="clientTLSCertificate" value="classpath:/credentials/sp.crt" size="90" /></td>
- </tr>
- <tr>
- <td>clientTLSPrivateKey</td>
- <td><input id="saml2-attribute-query-clientTLSPrivateKey" name="clientTLSPrivateKey" value="classpath:/credentials/sp.key" size="90" /></td>
- </tr>
- <tr>
- <td>clientTLSPassword</td>
- <td><input id="saml2-attribute-query-clientTLSPassword" name="clientTLSPassword" value="secret" size="20" /></td>
- </tr>
<tr>
<td>clientSigningCertificate</td>
<td><input id="saml2-attribute-query-clientSigningCertificate" name="clientSigningCertificate" value="classpath:/credentials/sp.crt" size="90" /></td>
@@ -295,32 +255,12 @@
<table>
<tr>
<td>endpoint</td>
- <td><input id="saml1-attribute-query-endpoint" name="endpoint" value="https://localhost:9443/idp/profile/SAML1/SOAP/AttributeQuery" size="60" /></td>
+ <td><input id="saml1-attribute-query-endpoint" name="endpoint" value="https://localhost:8443/idp/profile/SAML1/SOAP/AttributeQuery" size="60" /></td>
</tr>
<tr>
<td>principalName</td>
<td><input id="saml1-attribute-query-principalName" name="principalName" value="jdoe" /></td>
</tr>
- <tr>
- <td>trustedTLSCertificate</td>
- <td><input id="saml1-attribute-query-trustedTLSCertificate" name="trustedTLSCertificate" value="classpath:/credentials/idp-backchannel.p12" size="90" /></td>
- </tr>
- <tr>
- <td>trustedTLSCertificatePassword</td>
- <td><input id="saml1-attribute-query-trustedTLSCertificatePassword" name="trustedTLSCertificatePassword" value="changeit" size="20" /></td>
- </tr>
- <tr>
- <td>clientTLSCertificate</td>
- <td><input id="saml1-attribute-query-clientTLSCertificate" name="clientTLSCertificate" value="classpath:/credentials/sp.crt" size="90" /></td>
- </tr>
- <tr>
- <td>clientTLSPrivateKey</td>
- <td><input id="saml1-attribute-query-clientTLSPrivateKey" name="clientTLSPrivateKey" value="classpath:/credentials/sp.key" size="90" /></td>
- </tr>
- <tr>
- <td>clientTLSPassword</td>
- <td><input id="saml1-attribute-query-clientTLSPassword" name="clientTLSPassword" value="secret" size="20" /></td>
- </tr>
<tr>
<td>clientSigningCertificate</td>
<td><input id="saml1-attribute-query-clientSigningCertificate" name="clientSigningCertificate" value="classpath:/credentials/sp.crt" size="90" /></td>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list