[java-plugin-shibd] branch main updated: Combine some wiring, and move some defaults into properties.
Scott Cantor
cantor.2 at osu.edu
Mon Aug 11 20:20:14 UTC 2025
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-plugin-shibd.
View the commit online:
http://git.shibboleth.net/view/?p=java-plugin-shibd.git;a=commit;h=b526969ab35adb56cea2c2edc77917a5eb70d5f5
The following commit(s) were added to refs/heads/main by this push:
new b526969 Combine some wiring, and move some defaults into properties.
b526969 is described below
commit b526969ab35adb56cea2c2edc77917a5eb70d5f5
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Aug 11 16:20:12 2025 -0400
Combine some wiring, and move some defaults into properties.
---
.../META-INF/net.shibboleth.idp/postconfig.xml | 1 -
.../net/shibboleth/idp/module/conf/sp/agents.xml | 3 +-
.../shibboleth/idp/module/conf/sp/sp.properties | 5 ++
.../net/shibboleth/sp/conf/agents-system.xml | 46 +++++++++++++++++-
.../shibboleth/sp/conf/relying-party-system.xml | 54 ----------------------
5 files changed, 51 insertions(+), 58 deletions(-)
diff --git a/sp-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/sp-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 73798ac..2254916 100644
--- a/sp-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/sp-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -32,7 +32,6 @@
<property name="secondList">
<util:list >
<value>classpath:/net/shibboleth/sp/conf/agents-system.xml</value>
- <value>classpath:/net/shibboleth/sp/conf/relying-party-system.xml</value>
</util:list>
</property>
</bean>
diff --git a/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/agents.xml b/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/agents.xml
index 8842a62..e2f2868 100644
--- a/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/agents.xml
+++ b/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/agents.xml
@@ -26,8 +26,7 @@
<bean id="sp.example.org" parent="shibboleth.Agent">
<property name="applications">
<set>
- <bean p:id="default" parent="shibboleth.Application"
- p:authenticatingAuthority="https://idp.example.org" />
+ <bean p:id="default" parent="shibboleth.Application" />
</set>
</property>
</bean>
diff --git a/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/sp.properties b/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/sp.properties
index ed48880..cf4b569 100644
--- a/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/sp.properties
+++ b/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/sp.properties
@@ -1,6 +1,9 @@
# Default issuer/entityID/client_id/etc.
sp.issuer = https://sp.example.org
+# Default authentication authority (IdP, OP, etc.) to use if any
+#sp.defaultAuthority = https://idp.example.org
+
# Controls configuration of service to resolve SP agents and applications
# Uncomment and define to override service resources
#sp.service.agents.resources = shibboleth.AgentResolverResources
@@ -12,6 +15,8 @@ sp.service.agents.checkInterval = PT5M
# Set false to globally disable cookie-based authentication by agents
#sp.agent.authn.cached = true
#sp.agent.authn.cacheDuration = PT1H
+# Default agent IP address filter
+#sp.authn.allowedAddressRanges = 127.0.0.1/32, ::1/128
# Set to StorageService to use for remoted storage data if in use.
#sp.storageService = shibboleth.StorageService
diff --git a/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/agents-system.xml b/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/agents-system.xml
index 68088de..1227179 100644
--- a/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/agents-system.xml
+++ b/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/agents-system.xml
@@ -20,13 +20,18 @@
<!-- Parent beans for Agents and Applications. -->
+ <bean id="DefaultAllowedAddressRanges" parent="shibboleth.CommaDelimStringArray">
+ <constructor-arg type="java.lang.String" value="%{sp.authn.allowedAddressRanges:127.0.0.1/32,::1/128}" />
+ </bean>
+
<bean id="shibboleth.Agent" class="net.shibboleth.sp.impl.BasicAgent" abstract="true"
p:authenticationMethod="%{sp.agent.authn.method:basic}"
- p:allowedAddressRanges="#{{ '127.0.0.1/32', '::1/128' }}"
+ p:allowedAddressRanges-ref="DefaultAllowedAddressRanges"
p:supportsCachedAuthentication="%{sp.agent.authn.cached:true}" />
<bean id="shibboleth.Application" class="net.shibboleth.sp.impl.BasicApplication" abstract="true"
p:issuer="#{'%{sp.issuer:}'.trim()}"
+ p:authenticatingAuthority="%{sp.defaultAuthority:}"
p:metadataResolver-ref="shibboleth.MetadataResolverService"
p:attributeTranscoderRegistry-ref="shibboleth.AttributeRegistryService"
p:attributeResolver-ref="shibboleth.AttributeResolverService"
@@ -56,6 +61,45 @@
p:cookieManager-ref="shibboleth.RemotedCookieManager"
p:cookiePrefix="%{sp.stateToken.cookiePrefix:_Host-shibsp_state_}" />
+ <!-- More traditional beans akin to IdP service. -->
+
+ <bean id="shibboleth.DefaultSecurityConfiguration" class="org.opensaml.security.config.BasicSecurityConfiguration" />
+
+ <!-- Parent bean for generic RelyingParty overrides that establishes defaults. -->
+ <bean id="RelyingParty" abstract="true" class="net.shibboleth.profile.relyingparty.BasicRelyingPartyConfiguration"
+ p:issuer="#{'%{sp.issuer:}'.trim()}"
+ p:detailedErrorsPredicate="%{sp.errors.detailed:false}"
+ p:securityConfiguration-ref="#{'%{sp.security.config:shibboleth.DefaultSecurityConfiguration}'.trim()}"
+ p:profileConfigurations-ref="shibboleth.DefaultProfileConfigurations" />
+
+ <!-- Parent bean for RelyingParty overrides based on activation by name(s). -->
+ <bean id="RelyingPartyByName" abstract="true" parent="RelyingParty"
+ class="net.shibboleth.saml.relyingparty.RelyingPartyConfigurationSupport" factory-method="byName" />
+
+ <!-- Parent bean for RelyingParty overrides based on activation by group or SAML affiliation. -->
+ <bean id="RelyingPartyByGroup" abstract="true" parent="RelyingParty"
+ class="net.shibboleth.saml.relyingparty.RelyingPartyConfigurationSupport" factory-method="byGroup"
+ c:resolver-ref="shibboleth.MetadataResolver" />
+
+ <!-- Parent bean for RelyingParty overrides based on activation by local containment only. -->
+ <bean id="RelyingPartyByEntitiesDescriptor" abstract="true" parent="RelyingParty"
+ class="net.shibboleth.saml.relyingparty.RelyingPartyConfigurationSupport" factory-method="byGroup">
+ <constructor-arg name="resolver"><null /></constructor-arg>
+ </bean>
+
+ <!-- Parent bean for RelyingParty overrides based on activation by tag. -->
+ <bean id="RelyingPartyByTag" abstract="true" parent="RelyingParty"
+ class="net.shibboleth.saml.relyingparty.RelyingPartyConfigurationSupport" factory-method="byTag"
+ c:trim="false" c:matchAll="false" />
+
+ <!-- Parent bean for RelyingParty overrides based on activation by tag. -->
+ <bean id="RelyingPartyByMappedTag" abstract="true" parent="RelyingParty"
+ class="net.shibboleth.saml.relyingparty.RelyingPartyConfigurationSupport" factory-method="byMappedTag"
+ c:trim="false" c:matchAll="false" />
+
+ <bean id="TagCandidate" abstract="true"
+ class="org.opensaml.saml.common.profile.logic.EntityAttributesPredicate.Candidate" />
+
<!-- Wildcard import hook for plugins. -->
<import resource="classpath*:/META-INF/net/shibboleth/sp/service/agent/postconfig.xml" />
diff --git a/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/relying-party-system.xml b/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/relying-party-system.xml
deleted file mode 100644
index cde011c..0000000
--- a/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/relying-party-system.xml
+++ /dev/null
@@ -1,54 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
- xmlns:context="http://www.springframework.org/schema/context"
- xmlns:util="http://www.springframework.org/schema/util"
- xmlns:p="http://www.springframework.org/schema/p"
- xmlns:c="http://www.springframework.org/schema/c"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-
- default-init-method="initialize"
- default-destroy-method="destroy">
-
- <context:annotation-config/>
-
- <bean id="shibboleth.DefaultSecurityConfiguration" class="org.opensaml.security.config.BasicSecurityConfiguration" />
-
- <!-- Parent bean for generic RelyingParty overrides that establishes defaults. -->
- <bean id="RelyingParty" abstract="true" class="net.shibboleth.profile.relyingparty.BasicRelyingPartyConfiguration"
- p:issuer="#{'%{sp.issuer:}'.trim()}"
- p:detailedErrorsPredicate="%{sp.errors.detailed:false}"
- p:securityConfiguration-ref="#{'%{sp.security.config:shibboleth.DefaultSecurityConfiguration}'.trim()}"
- p:profileConfigurations-ref="shibboleth.DefaultProfileConfigurations" />
-
- <!-- Parent bean for RelyingParty overrides based on activation by name(s). -->
- <bean id="RelyingPartyByName" abstract="true" parent="RelyingParty"
- class="net.shibboleth.saml.relyingparty.RelyingPartyConfigurationSupport" factory-method="byName" />
-
- <!-- Parent bean for RelyingParty overrides based on activation by group or SAML affiliation. -->
- <bean id="RelyingPartyByGroup" abstract="true" parent="RelyingParty"
- class="net.shibboleth.saml.relyingparty.RelyingPartyConfigurationSupport" factory-method="byGroup"
- c:resolver-ref="shibboleth.MetadataResolver" />
-
- <!-- Parent bean for RelyingParty overrides based on activation by local containment only. -->
- <bean id="RelyingPartyByEntitiesDescriptor" abstract="true" parent="RelyingParty"
- class="net.shibboleth.saml.relyingparty.RelyingPartyConfigurationSupport" factory-method="byGroup">
- <constructor-arg name="resolver"><null /></constructor-arg>
- </bean>
-
- <!-- Parent bean for RelyingParty overrides based on activation by tag. -->
- <bean id="RelyingPartyByTag" abstract="true" parent="RelyingParty"
- class="net.shibboleth.saml.relyingparty.RelyingPartyConfigurationSupport" factory-method="byTag"
- c:trim="false" c:matchAll="false" />
-
- <!-- Parent bean for RelyingParty overrides based on activation by tag. -->
- <bean id="RelyingPartyByMappedTag" abstract="true" parent="RelyingParty"
- class="net.shibboleth.saml.relyingparty.RelyingPartyConfigurationSupport" factory-method="byMappedTag"
- c:trim="false" c:matchAll="false" />
-
- <bean id="TagCandidate" abstract="true"
- class="org.opensaml.saml.common.profile.logic.EntityAttributesPredicate.Candidate" />
-
-</beans>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list