[java-plugin-shibd] branch main updated: WIP on config layout of agents, applications, relying party configs.
Scott Cantor
cantor.2 at osu.edu
Tue May 14 20:50:42 UTC 2024
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-plugin-shibd.
View the commit online:
http://git.shibboleth.net/view/?p=java-plugin-shibd.git;a=commit;h=6d101a73413adc8a357384910a4acec519cc114f
The following commit(s) were added to refs/heads/main by this push:
new 6d101a7 WIP on config layout of agents, applications, relying party configs.
6d101a7 is described below
commit 6d101a73413adc8a357384910a4acec519cc114f
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue May 14 16:50:39 2024 -0400
WIP on config layout of agents, applications, relying party configs.
---
.../META-INF/net.shibboleth.idp/postconfig.xml | 7 +-
sp-conf-impl/src/main/resources/logback.xml | 12 ---
.../net/shibboleth/idp/module/conf/sp/agents.xml | 91 ++++++++++++++++++++++
.../conf => idp/module/conf/sp}/credentials.xml | 30 ++-----
.../shibboleth/idp/module/conf/sp/sp.properties | 22 ++++++
.../{applications-system.xml => agents-system.xml} | 31 +++-----
.../net/shibboleth/sp/conf/module.properties | 8 +-
.../shibboleth/sp/conf/relying-party-system.xml | 34 +-------
.../net/shibboleth/sp/module/conf/applications.xml | 19 -----
.../net/shibboleth/sp/module/conf/sp.properties | 31 --------
.../src/main/java/net/shibboleth/sp/Agent.java | 13 ++++
.../main/java/net/shibboleth/sp/Application.java | 16 ++++
.../java/net/shibboleth/sp/impl/BasicAgent.java | 39 ++++++++++
.../net/shibboleth/sp/impl/BasicApplication.java | 57 +++++++++++++-
.../sp/impl/DefaultApplicationResolver.java | 21 ++++-
15 files changed, 285 insertions(+), 146 deletions(-)
diff --git a/sp-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/sp-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 15e1cc0..a0c4a20 100644
--- a/sp-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/sp-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -17,13 +17,13 @@
<!-- Application reseolver service. -->
<bean id="shibboleth.sp.ApplicationResolver" parent="shibboleth.ReloadableService"
- c:claz="TBD"
+ c:claz="net.shibboleth.sp.impl.DefaultApplicationResolver"
p:serviceConfigurations-ref="ExtendedApplicationResolverResources"
p:failFast="%{sp.service.applications.failFast:%{idp.service.failFast:false}}"
p:reloadCheckDelay="%{sp.service.applications.checkInterval:PT0S}" />
<util:list id="shibboleth.DefaultApplicationResolverResources">
- <value>conditional:%{idp.home}/conf/sp/applications.xml</value>
+ <value>conditional:%{idp.home}/conf/sp/agents.xml</value>
</util:list>
<!-- Auto-append system config files to resource set. -->
@@ -32,7 +32,8 @@
getObject('shibboleth.DefaultApplicationResolverResources')}">
<property name="secondList">
<util:list >
- <value>classpath:/net/shibboleth/sp/conf/applications-system.xml</value>
+ <value>classpath:/net/shibboleth/sp/conf/agents-system.xml</value>
+ <value>classpath:/net/shibboleth/sp/conf/relying-party-system.xml</value>
</util:list>
</property>
</bean>
diff --git a/sp-conf-impl/src/main/resources/logback.xml b/sp-conf-impl/src/main/resources/logback.xml
deleted file mode 100644
index 3241ab2..0000000
--- a/sp-conf-impl/src/main/resources/logback.xml
+++ /dev/null
@@ -1,12 +0,0 @@
-<configuration>
- <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
- <encoder class="ch.qos.logback.classic.encoder.PatternLayoutEncoder">
- <charset>UTF-8</charset>
- <Pattern>%date{yyyy-MM-dd HH:mm:ss.SSS} [%5level] : %logger: %msg%n</Pattern>
- </encoder>
- </appender>
-
- <root level="info">
- <appender-ref ref="STDOUT" />
- </root>
-</configuration>
diff --git a/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/agents.xml b/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/agents.xml
new file mode 100644
index 0000000..6f5f117
--- /dev/null
+++ b/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/agents.xml
@@ -0,0 +1,91 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:context="http://www.springframework.org/schema/context"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:c="http://www.springframework.org/schema/c"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+
+ default-init-method="initialize"
+ default-destroy-method="destroy">
+
+ <!--
+ This is a master file defining the Agents, Applications, and RelyingParty configurations to use.
+ You can add any number of additional imported files to organize your configuration.
+ -->
+
+ <import resource="credentials.xml" />
+
+ <!-- ============ RelyingParty defaults ============ -->
+
+ <!--
+ These beans are wired into *all* applications across all agents by default. You can create
+ customized alternatives in whatever combination you require to plug into specific application
+ beans.
+ -->
+
+ <!--
+ Unverified RP configuration, defaults to no support for any profiles. Add <ref> elements to the list
+ to enable specific default profile settings (as below), or create new beans inline to override defaults.
+
+ "Unverified" typically means the SP has no metadata, or equivalent way of assuring the identity and
+ legitimacy of an IdP system. To run an "open" SP, you can enable profiles here.
+ -->
+ <bean id="shibboleth.UnverifiedRelyingParty" parent="RelyingParty">
+ <property name="profileConfigurations">
+ <list>
+ <!-- <bean parent="SAML2.SSO" /> -->
+ </list>
+ </property>
+ </bean>
+
+ <!--
+ Default configuration, with default settings applied for all profiles.
+
+ Take care with any defaults you apply at this level because you will have to create
+ overrides or apply metadata tags for every single SP that requires a different setting.
+ Changed defaults should be things you really do want to apply to nearly every SP.
+ -->
+ <bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty">
+ <property name="profileConfigurations">
+ <list>
+ <ref bean="SAML2.SSO" />
+ <ref bean="SAML2.Logout" />
+ </list>
+ </property>
+ </bean>
+
+ <!-- Container for any overrides you want to add. -->
+
+ <util:list id="shibboleth.RelyingPartyOverrides">
+
+ <!--
+ Override example that identifies a single IdP by name and configures it
+ for SAML 2 SSO with a different security configuration.
+ -->
+ <!--
+ <bean id="CustomKey" parent="RelyingPartyByName" c:relyingPartyIds="https://idp.example.org">
+ <property name="profileConfigurations">
+ <list>
+ <bean parent="SAML2.SSO" p:securityConfiguration-ref="custom.SecurityConfig" />
+ </list>
+ </property>
+ </bean>
+ -->
+
+ </util:list>
+
+ <!-- ============ Agents ============ -->
+
+ <bean id="sp.example.org" parent="shibboleth.Agent">
+ <property name="applications">
+ <set>
+ <bean p:id="default" parent="shibboleth.Application" p:issuer="https://sp.example.org"/>
+ </set>
+ </property>
+ </bean>
+
+</beans>
diff --git a/sp-conf-impl/src/main/resources/net/shibboleth/sp/module/conf/credentials.xml b/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/credentials.xml
similarity index 68%
rename from sp-conf-impl/src/main/resources/net/shibboleth/sp/module/conf/credentials.xml
rename to sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/credentials.xml
index f92cf1a..fb1f6e1 100644
--- a/sp-conf-impl/src/main/resources/net/shibboleth/sp/module/conf/credentials.xml
+++ b/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/credentials.xml
@@ -13,42 +13,25 @@
default-destroy-method="destroy">
<!--
- This defines the signing and encryption key and certificate pairs referenced by your asserting-party.xml
+ This defines the signing and encryption key and certificate pairs referenced by your agent/application
configuration. You don't normally need to touch this, unless you have advanced requirements such as
supporting multiple sets of keys for different IdPs, in which case you may want to define all your
- credentials here for convenience.
+ credentials here for convenience and reference them as needed.
-->
-
- <!--
- The list of ALL of your SP's signing credentials. If you define additional signing credentials,
- for example for specific IdPs or different key types, make sure to include them within this list.
- -->
- <util:list id="shibboleth.SigningCredentials">
- <ref bean="shibboleth.DefaultSigningCredential" />
- </util:list>
<!-- Your SP's default signing key, set via property file. -->
<bean id="shibboleth.DefaultSigningCredential" parent="shibboleth.BasicX509CredentialFactoryBean"
p:privateKeyResource="%{sp.signing.key}"
- p:certificateResource="%{sp.signing.cert}"
- p:entityId-ref="entityID" />
+ p:certificateResource="%{sp.signing.cert}" />
<!-- Your SPs default client TLS credential, by default the same as the default signing credential. -->
<alias alias="shibboleth.DefaultClientTLSCredential" name="shibboleth.DefaultSigningCredential" />
-
- <!--
- The list of ALL of your SP's encryption credentials. By default this is just an alias
- for 'shibboleth.DefaultEncryptionCredentials'. It could be re-defined as
- a list with additional credentials if needed.
- -->
- <alias alias="shibboleth.EncryptionCredentials" name="shibboleth.DefaultEncryptionCredentials" />
-
+
<!-- Your SP's default encryption (really decryption) keys, set via property file. -->
<util:list id="shibboleth.DefaultEncryptionCredentials">
<bean parent="shibboleth.BasicX509CredentialFactoryBean"
p:privateKeyResource="%{sp.encryption.key}"
- p:certificateResource="%{sp.encryption.cert}"
- p:entityId-ref="entityID" />
+ p:certificateResource="%{sp.encryption.cert}" />
<!--
For key rollover, uncomment and point to your original keypair, and use the one above
@@ -57,8 +40,7 @@
<!--
<bean parent="shibboleth.BasicX509CredentialFactoryBean"
p:privateKeyResource="%{sp.encryption.key.2}"
- p:certificateResource="%{sp.encryption.cert.2}"
- p:entityId-ref="entityID" />
+ p:certificateResource="%{sp.encryption.cert.2}" />
-->
</util:list>
diff --git a/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/sp.properties b/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/sp.properties
new file mode 100644
index 0000000..705abcb
--- /dev/null
+++ b/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/sp.properties
@@ -0,0 +1,22 @@
+# Controls configuration of new "SP" service.
+# Uncomment and define to override service resources
+#sp.service.applications.resources = shibboleth.ApplicationResolverResources
+#sp.service.applications.failFast = false
+sp.service.applications.checkInterval = PT5M
+
+# General SP cookie properties (maxAge only applies to persistent cookies)
+#sp.cookie.secure = true
+#sp.cookie.httpOnly = true
+#sp.cookie.domain =
+#sp.cookie.path =
+#sp.cookie.maxAge = 31536000
+
+# Settings for SP public/private signing and encryption key(s)
+# During decryption key rollover, point the ".2" properties at a second
+# keypair, uncomment in credentials.xml, then publish it in your metadata.
+sp.signing.key = %{idp.home}/credentials/sp/sp-signing.key
+sp.signing.cert = %{idp.home}/credentials/sp/sp-signing.crt
+sp.encryption.key = %{idp.home}/credentials/sp/sp-encryption.key
+sp.encryption.cert = %{idp.home}/credentials/sp/sp-encryption.crt
+#sp.encryption.key.2 = %{idp.home}/credentials/sp/sp-encryption-old.key
+#sp.encryption.cert.2 = %{idp.home}/credentials/sp/sp-encryption-old.crt
diff --git a/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/applications-system.xml b/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/agents-system.xml
similarity index 52%
rename from sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/applications-system.xml
rename to sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/agents-system.xml
index cb9dcc7..de13a90 100644
--- a/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/applications-system.xml
+++ b/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/agents-system.xml
@@ -15,35 +15,24 @@
<!-- Needed to allow for auto-wiring of components. -->
<context:annotation-config />
- <!-- ServiceableComponent exposed to the root context. -->
-<!-- <bean class="net.shibboleth.sp.remoting.impl.ReloadingEndpointManager" -->
-<!-- c:_0-ref="shibboleth.EndpointManager" -->
-<!-- p:id="shibboleth.ReloadingEndpointManager" /> -->
+ <!-- Exposes auto-wired map of Agents. -->
+ <bean id="shibboleth.ApplicationResolver" class="net.shibboleth.sp.impl.DefaultApplicationResolver" />
- <!-- This bean auto-wires the remoting endpoints into a map exposed by the surrounding service. -->
- <bean id="shibboleth.EndpointManager" class="net.shibboleth.sp.remoting.impl.BasicEndpointManager" />
+ <!-- Parent beans for Agents and Applications. -->
- <!-- This bean auto-wires the application-aware endpoints into a map. -->
- <bean id="shibboleth.ApplicationEndpointManager" class="net.shibboleth.sp.remoting.impl.BasicApplicationEndpointManager" />
-
- <!-- Auto-wired remoting endpoints. -->
-
- <bean class="net.shibboleth.sp.remoting.endpoint.impl.Echo" />
- <bean class="net.shibboleth.sp.remoting.endpoint.impl.Ping" />
- <bean class="net.shibboleth.sp.remoting.endpoint.impl.XMLParser"
- p:parserPool-ref="shibboleth.DefaultParserPool" />
-
-<!-- <bean class="net.shibboleth.sp.remoting.endpoint.impl.WebFlow"-->
-<!-- p:flowExecutor-ref="flowExecutor" />-->
+ <bean id="shibboleth.Agent" class="net.shibboleth.sp.impl.BasicAgent" abstract="true" />
<bean id="shibboleth.Application" class="net.shibboleth.sp.impl.BasicApplication" abstract="true"
- p:endpointManager-ref="shibboleth.ApplicationEndpointManager"
p:metadataResolver-ref="shibboleth.MetadataResolverService"
p:attributeTranscoderRegistry-ref="shibboleth.AttributeRegistryService"
p:attributeResolver-ref="shibboleth.AttributeResolverService"
- p:attributeFilter-ref="shibboleth.AttributeFilterService" />
+ p:attributeFilter-ref="shibboleth.AttributeFilterService"
+ p:unverifiedConfiguration-ref="shibboleth.UnverifiedRelyingParty"
+ p:defaultConfiguration-ref="shibboleth.DefaultRelyingParty"
+ p:relyingPartyConfigurations-ref="shibboleth.RelyingPartyOverrides"
+ p:metricName="net.shibboleth.sp.relyingparty.configurations" />
<!-- Wildcard import hook for plugins. -->
- <import resource="classpath*:/META-INF/net/shibboleth/idp/service/sp/postconfig.xml" />
+ <import resource="classpath*:/META-INF/net/shibboleth/sp/service/application/postconfig.xml" />
</beans>
diff --git a/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/module.properties b/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/module.properties
index 6c9940e..0918f42 100644
--- a/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/module.properties
+++ b/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/module.properties
@@ -10,11 +10,11 @@ sp.Core.name = SP Server Hub
sp.Core.desc = Shared hub for SP agent processing.
sp.Core.url = /SP
-sp.Core.1.src = /net/shibboleth/sp/module/conf/applications.xml
-sp.Core.1.dest = conf/sp/applicatons.xml
+sp.Core.1.src = /net/shibboleth/idp/module/conf/sp/agents.xml
+sp.Core.1.dest = conf/sp/agents.xml
-sp.Core.2.src = /net/shibboleth/sp/module/conf/credentials.xml
+sp.Core.2.src = /net/shibboleth/idp/module/conf/sp/credentials.xml
sp.Core.2.dest = conf/sp/credentials.xml
-sp.Core.3.src = /net/shibboleth/sp/module/conf/sp.properties
+sp.Core.3.src = /net/shibboleth/idp/module/conf/sp/sp.properties
sp.Core.3.dest = conf/sp/sp.properties
diff --git a/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/relying-party-system.xml b/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/relying-party-system.xml
index 31862ce..4f32b54 100644
--- a/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/relying-party-system.xml
+++ b/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/relying-party-system.xml
@@ -13,33 +13,11 @@
default-destroy-method="destroy">
<context:annotation-config/>
-
- <!-- This is one of the few properties we rely on that has no default. -->
- <bean id="entityID" class="java.lang.String" c:_0="%{sp.entityID}" />
-
- <!-- Pulls together the various components that feed the resolver.
- <bean class="net.shibboleth.profile.relyingparty.impl.DefaultRelyingPartyConfigurationResolver"
- p:unverifiedConfiguration-ref="shibboleth.UnverifiedRelyingParty"
- p:defaultConfiguration-ref="shibboleth.DefaultRelyingParty"
- p:relyingPartyConfigurations-ref="shibboleth.RelyingPartyOverrides"
- p:defaultSecurityConfiguration-ref="%{sp.security.config:shibboleth.DefaultSecurityConfiguration}" />
- -->
- <!--
- Auto-wiring exposers for credentials to get them loaded into the bean above.
- The qualifiers control which auto-wiring point is used.
- -->
- <bean class="net.shibboleth.spring.security.CredentialHolder"
- c:_0="#{getObject('shibboleth.SigningCredentials')}">
- <qualifier value="signing"/>
- </bean>
- <bean class="net.shibboleth.spring.security.CredentialHolder"
- c:_0="#{getObject('shibboleth.EncryptionCredentials')}">
- <qualifier value="encryption"/>
- </bean>
-
<!-- Parent bean for generic RelyingParty overrides that establishes defaults. -->
- <bean id="RelyingParty" abstract="true" class="net.shibboleth.profile.relyingparty.RelyingPartyConfiguration" />
+ <bean id="RelyingParty" abstract="true" class="net.shibboleth.profile.relyingparty.BasicRelyingPartyConfiguration"
+ p:detailedErrorsPredicate="%{sp.errors.detailed:false}"
+ p:securityConfiguration-ref="%{sp.security.config:shibboleth.DefaultSecurityConfiguration}" />
<!-- Parent bean for RelyingParty overrides based on activation by name(s). -->
<bean id="RelyingPartyByName" abstract="true" parent="RelyingParty"
@@ -354,8 +332,7 @@
</bean>
<!-- Defines how the system locates EncryptedKey elements sent in messages containing encrypted objects. -->
- <bean id="defaultEncryptedKeyResolver" class="org.opensaml.xmlsec.encryption.support.ChainingEncryptedKeyResolver"
- c:recipients="#{getObject('shibboleth.DecryptionRecipients') ?: getObject('entityID')}">
+ <bean id="defaultEncryptedKeyResolver" class="org.opensaml.xmlsec.encryption.support.ChainingEncryptedKeyResolver">
<constructor-arg name="encKeyResolvers">
<list>
<bean class="org.opensaml.xmlsec.encryption.support.InlineEncryptedKeyResolver" />
@@ -366,7 +343,4 @@
</constructor-arg>
</bean>
- <!-- Wildcard import hook for plugins. -->
- <import resource="classpath*:/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml" />
-
</beans>
diff --git a/sp-conf-impl/src/main/resources/net/shibboleth/sp/module/conf/applications.xml b/sp-conf-impl/src/main/resources/net/shibboleth/sp/module/conf/applications.xml
deleted file mode 100644
index 663b35b..0000000
--- a/sp-conf-impl/src/main/resources/net/shibboleth/sp/module/conf/applications.xml
+++ /dev/null
@@ -1,19 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
- xmlns:context="http://www.springframework.org/schema/context"
- xmlns:util="http://www.springframework.org/schema/util"
- xmlns:p="http://www.springframework.org/schema/p"
- xmlns:c="http://www.springframework.org/schema/c"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-
- default-init-method="initialize"
- default-destroy-method="destroy">
-
- <!-- This is the master file defining the Applications to deploy on behalf of agents. -->
-
- <bean id="sp.example.org-default" parent="shibboleth.Application" />
-
-</beans>
diff --git a/sp-conf-impl/src/main/resources/net/shibboleth/sp/module/conf/sp.properties b/sp-conf-impl/src/main/resources/net/shibboleth/sp/module/conf/sp.properties
deleted file mode 100644
index 0d79feb..0000000
--- a/sp-conf-impl/src/main/resources/net/shibboleth/sp/module/conf/sp.properties
+++ /dev/null
@@ -1,31 +0,0 @@
-# Networking settings for socket listener.
-#sp.service.address = 127.0.0.1
-#sp.service.port = 1600
-#sp.service.allowedRanges = 127.0.0.1/32, ::1/128
-# Set to true for better performance.
-#sp.service.prefixLength = false
-
-# Controls configuration of new "SP" service.
-#idp.service.sp.resources = shibboleth.ServiceProviderResources
-#idp.service.sp.failFast = false
-idp.service.sp.checkInterval = PT5M
-
-# Set the (defaylt) entityID of the SP
-sp.entityID = https://sp.example.org
-
-# General SP cookie properties (maxAge only applies to persistent cookies)
-#sp.cookie.secure = true
-#sp.cookie.httpOnly = true
-#sp.cookie.domain =
-#sp.cookie.path =
-#sp.cookie.maxAge = 31536000
-
-# Settings for SP public/private signing and encryption key(s)
-# During decryption key rollover, point the ".2" properties at a second
-# keypair, uncomment in credentials.xml, then publish it in your metadata.
-sp.signing.key = %{idp.home}/credentials/sp-signing.key
-sp.signing.cert = %{idp.home}/credentials/sp-signing.crt
-sp.encryption.key = %{idp.home}/credentials/sp-encryption.key
-sp.encryption.cert = %{idp.home}/credentials/sp-encryption.crt
-#sp.encryption.key.2 = %{idp.home}/credentials/sp-encryption-old.key
-#sp.encryption.cert.2 = %{idp.home}/credentials/sp-encryption-old.crt
diff --git a/sp-server-api/src/main/java/net/shibboleth/sp/Agent.java b/sp-server-api/src/main/java/net/shibboleth/sp/Agent.java
index d900459..7985473 100644
--- a/sp-server-api/src/main/java/net/shibboleth/sp/Agent.java
+++ b/sp-server-api/src/main/java/net/shibboleth/sp/Agent.java
@@ -21,6 +21,8 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import javax.annotation.concurrent.ThreadSafe;
+import org.opensaml.profile.context.ProfileRequestContext;
+
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.component.IdentifiedComponent;
@@ -34,6 +36,17 @@ import net.shibboleth.shared.component.IdentifiedComponent;
@ThreadSafe
public interface Agent extends IdentifiedComponent {
+ /**
+ * Get the issuer value to use in various identity protocols when identifying this agent.
+ *
+ * <p>Note that this value may be overridden by {@link Application}.</p>
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return default issue value to use
+ */
+ @Nullable @NotEmpty String getIssuer(@Nonnull final ProfileRequestContext profileRequestContext);
+
/**
* Get the {@link Application} instances associated with this agent.
*
diff --git a/sp-server-api/src/main/java/net/shibboleth/sp/Application.java b/sp-server-api/src/main/java/net/shibboleth/sp/Application.java
index 86e43cb..0a34bc7 100644
--- a/sp-server-api/src/main/java/net/shibboleth/sp/Application.java
+++ b/sp-server-api/src/main/java/net/shibboleth/sp/Application.java
@@ -16,15 +16,19 @@
package net.shibboleth.sp;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import javax.annotation.concurrent.ThreadSafe;
+import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.criterion.ProfileRequestContextCriterion;
import org.opensaml.saml.metadata.resolver.MetadataResolver;
import net.shibboleth.idp.attribute.filter.AttributeFilter;
import net.shibboleth.idp.attribute.resolver.AttributeResolver;
import net.shibboleth.idp.attribute.transcoding.AttributeTranscoderRegistry;
+import net.shibboleth.profile.config.ProfileConfiguration;
import net.shibboleth.profile.relyingparty.RelyingPartyConfigurationResolver;
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.service.ServiceException;
import net.shibboleth.shared.service.ServiceableComponent;
@@ -42,6 +46,18 @@ import net.shibboleth.shared.service.ServiceableComponent;
@ThreadSafe
public interface Application extends RelyingPartyConfigurationResolver {
+ /**
+ * Get the issuer value to use in various identity protocols when identifying this application.
+ *
+ * <p>Note that this value may be overridden via a relevant {@link ProfileConfiguration} obtained via
+ * the implemented {@link RelyingPartyConfigurationResolver}.</p>
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return default issue value to use
+ */
+ @Nullable @NotEmpty String getIssuer(@Nonnull final ProfileRequestContext profileRequestContext);
+
/**
* Get {@link MetadataResolver} for this {@link Application}.
*
diff --git a/sp-server-impl/src/main/java/net/shibboleth/sp/impl/BasicAgent.java b/sp-server-impl/src/main/java/net/shibboleth/sp/impl/BasicAgent.java
index b0e49a5..a3073ad 100644
--- a/sp-server-impl/src/main/java/net/shibboleth/sp/impl/BasicAgent.java
+++ b/sp-server-impl/src/main/java/net/shibboleth/sp/impl/BasicAgent.java
@@ -19,16 +19,22 @@ import java.util.Collection;
import java.util.Map;
import java.util.Objects;
import java.util.Set;
+import java.util.function.Function;
import java.util.stream.Collectors;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import org.opensaml.profile.context.ProfileRequestContext;
+
import com.google.common.base.Functions;
import com.google.common.base.MoreObjects;
import net.shibboleth.profile.relyingparty.impl.DefaultRelyingPartyConfigurationResolver;
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.collection.CollectionSupport;
+import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.logic.FunctionSupport;
import net.shibboleth.sp.Agent;
import net.shibboleth.sp.Application;
@@ -37,13 +43,46 @@ import net.shibboleth.sp.Application;
*/
public class BasicAgent extends DefaultRelyingPartyConfigurationResolver implements Agent {
+ /** Application map. */
@Nonnull private Map<String,Application> applicationMap;
+ /** Lookup strategy for issuer. */
+ @Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
+
/** Constructor. */
public BasicAgent() {
applicationMap = CollectionSupport.emptyMap();
+ issuerLookupStrategy = FunctionSupport.constant(null);
}
+ /** {@inheritDoc} */
+ @Nullable @NotEmpty public String getIssuer(@Nullable final ProfileRequestContext profileRequestContext) {
+ return issuerLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Set default issuer value to use for this application.
+ *
+ * @param issuer issuer value
+ */
+ public void setIssuer(@Nullable @NotEmpty final String issuer) {
+ checkSetterPreconditions();
+
+ final String trimmed = Constraint.isNotNull(issuer, "Issuer cannot be null or empty");
+ issuerLookupStrategy = FunctionSupport.constant(trimmed);
+ }
+
+ /**
+ * Set default issuer lookup strategy to use for this application.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setIssuer(@Nonnull final Function<ProfileRequestContext,String> strategy) {
+ checkSetterPreconditions();
+
+ issuerLookupStrategy = Constraint.isNotNull(strategy, "Issuer lookup strategy cannot be null");
+ }
+
/**
* Sets the {@link Application} instances associated with this agent.
*
diff --git a/sp-server-impl/src/main/java/net/shibboleth/sp/impl/BasicApplication.java b/sp-server-impl/src/main/java/net/shibboleth/sp/impl/BasicApplication.java
index 8e8b76d..f922b79 100644
--- a/sp-server-impl/src/main/java/net/shibboleth/sp/impl/BasicApplication.java
+++ b/sp-server-impl/src/main/java/net/shibboleth/sp/impl/BasicApplication.java
@@ -16,11 +16,15 @@
package net.shibboleth.sp.impl;
import java.util.Objects;
+import java.util.function.Function;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.saml.metadata.resolver.MetadataResolver;
+import com.codahale.metrics.MetricRegistry;
import com.google.common.base.MoreObjects;
import net.shibboleth.idp.attribute.filter.AttributeFilter;
@@ -28,8 +32,10 @@ import net.shibboleth.idp.attribute.resolver.AttributeResolver;
import net.shibboleth.idp.attribute.transcoding.AttributeTranscoderRegistry;
import net.shibboleth.profile.relyingparty.impl.DefaultRelyingPartyConfigurationResolver;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.logic.FunctionSupport;
import net.shibboleth.shared.service.ReloadableService;
import net.shibboleth.shared.service.ServiceException;
import net.shibboleth.shared.service.ServiceableComponent;
@@ -40,6 +46,9 @@ import net.shibboleth.sp.Application;
*/
public class BasicApplication extends DefaultRelyingPartyConfigurationResolver implements Application {
+ /** Lookup strategy for issuer. */
+ @Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
+
/** Metadata source. */
@NonnullAfterInit private ReloadableService<MetadataResolver> metadataResolver;
@@ -51,7 +60,12 @@ public class BasicApplication extends DefaultRelyingPartyConfigurationResolver i
/** Attribute filter. */
@NonnullAfterInit private ReloadableService<AttributeFilter> attributeFilter;
-
+
+ /** Constructor. */
+ public BasicApplication() {
+ issuerLookupStrategy = FunctionSupport.constant(null);
+ }
+
/** {@inheritDoc} */
@Override
protected void doInitialize() throws ComponentInitializationException {
@@ -68,6 +82,47 @@ public class BasicApplication extends DefaultRelyingPartyConfigurationResolver i
}
}
+ /** {@inheritDoc} */
+ @Override
+ @Nullable public String getMetricName() {
+
+ final String base = super.getMetricName();
+ if (base != null) {
+ // TODO: get access to agent ID for metrics
+ return MetricRegistry.name(base, getId());
+ }
+
+ return null;
+ }
+
+ /** {@inheritDoc} */
+ @Nullable @NotEmpty public String getIssuer(@Nullable final ProfileRequestContext profileRequestContext) {
+ return issuerLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Set default issuer value to use for this application.
+ *
+ * @param issuer issuer value
+ */
+ public void setIssuer(@Nullable @NotEmpty final String issuer) {
+ checkSetterPreconditions();
+
+ final String trimmed = Constraint.isNotNull(issuer, "Issuer cannot be null or empty");
+ issuerLookupStrategy = FunctionSupport.constant(trimmed);
+ }
+
+ /**
+ * Set default issuer lookup strategy to use for this application.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setIssuer(@Nonnull final Function<ProfileRequestContext,String> strategy) {
+ checkSetterPreconditions();
+
+ issuerLookupStrategy = Constraint.isNotNull(strategy, "Issuer lookup strategy cannot be null");
+ }
+
/** {@inheritDoc} */
@Nonnull public ServiceableComponent<MetadataResolver> getMetadataResolver() throws ServiceException {
return metadataResolver.getServiceableComponent();
diff --git a/sp-server-impl/src/main/java/net/shibboleth/sp/impl/DefaultApplicationResolver.java b/sp-server-impl/src/main/java/net/shibboleth/sp/impl/DefaultApplicationResolver.java
index 2210d10..adc9623 100644
--- a/sp-server-impl/src/main/java/net/shibboleth/sp/impl/DefaultApplicationResolver.java
+++ b/sp-server-impl/src/main/java/net/shibboleth/sp/impl/DefaultApplicationResolver.java
@@ -27,7 +27,10 @@ import org.springframework.beans.factory.annotation.Autowired;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.component.ComponentInitializationException;
+import net.shibboleth.shared.component.IdentifiableComponent;
import net.shibboleth.shared.component.InitializableComponent;
+import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.StringSupport;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
import net.shibboleth.shared.spring.config.IdentifiedComponentManager;
@@ -40,7 +43,11 @@ import net.shibboleth.sp.ApplicationResolver;
/**
* Default implementation of {@link ApplicationResolver}.
*/
-public class DefaultApplicationResolver extends IdentifiedComponentManager<Agent> implements ApplicationResolver, InitializableComponent {
+public class DefaultApplicationResolver extends IdentifiedComponentManager<Agent>
+ implements ApplicationResolver, InitializableComponent, IdentifiableComponent {
+
+ /** Identifier. */
+ @Nullable String id;
/** Tracks init state. */
private boolean initialized;
@@ -58,6 +65,18 @@ public class DefaultApplicationResolver extends IdentifiedComponentManager<Agent
super(agents);
}
+ /** {@inheritDoc} */
+ @Nullable public String getId() {
+ return id;
+ }
+
+ /** {@inheritDoc} */
+ public void setId(@Nonnull final String componentId) {
+ if (!initialized) {
+ id = Constraint.isNotNull(StringSupport.trimOrNull(componentId), "ID cannot be null or empty");
+ }
+ }
+
/** {@inheritDoc} */
public void initialize() throws ComponentInitializationException {
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list