[java-plugin-shibd] branch main updated: Flesh out beans and properties for agent authn.
Scott Cantor
cantor.2 at osu.edu
Tue Aug 12 18:22:01 UTC 2025
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-plugin-shibd.
View the commit online:
http://git.shibboleth.net/view/?p=java-plugin-shibd.git;a=commit;h=28d53311870b7b0a5d12e3b96c70d66ce3823cd7
The following commit(s) were added to refs/heads/main by this push:
new 28d5331 Flesh out beans and properties for agent authn.
28d5331 is described below
commit 28d53311870b7b0a5d12e3b96c70d66ce3823cd7
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Aug 12 14:21:58 2025 -0400
Flesh out beans and properties for agent authn.
---
.../idp/flows/sp/abstract/sp-abstract-beans.xml | 95 ++++++++++++++--------
.../shibboleth/idp/module/conf/sp/sp.properties | 95 +++++++++++++++++++---
2 files changed, 144 insertions(+), 46 deletions(-)
diff --git a/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/abstract/sp-abstract-beans.xml b/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/abstract/sp-abstract-beans.xml
index 77077d4..2553e91 100644
--- a/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/abstract/sp-abstract-beans.xml
+++ b/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/abstract/sp-abstract-beans.xml
@@ -45,7 +45,7 @@
p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier"
p:cacheDuration="%{sp.agent.authn.cacheDuration:PT1H}"
p:requireAll="%{sp.agent.authn.requireAll:false}"
- p:validators="#{getObject('shibboleth.AgentValidators') ?: getObject('DefaultAgentValidators')}"
+ p:validators="#{getObject('shibboleth.sp.AgentValidators') ?: getObject('DefaultAgentValidators')}"
p:cleanupHook-ref="DefaultCleanupHook" />
<bean id="DefaultCleanupHook"
@@ -66,55 +66,78 @@
<!-- ======== Beans for agent authentication ======== -->
<util:list id="DefaultAgentValidators">
- <ref bean="shibboleth.AgentSecretValidator" />
+ <!-- Default just uses secrets defined in agents.xml file. -->
+ <ref bean="shibboleth.sp.AgentSecretValidator" />
</util:list>
<!-- Validator parent beans -->
- <bean id="shibboleth.CredentialValidator" abstract="true"
+ <bean id="shibboleth.sp.CredentialValidator" abstract="true"
p:savePasswordToCredentialSet="%{sp.agent.authn.retainAsPrivateCredential:false}" />
- <bean id="shibboleth.AgentSecretValidator" parent="shibboleth.CredentialValidator"
+ <bean id="shibboleth.sp.AgentSecretValidator" parent="shibboleth.sp.CredentialValidator"
class="net.shibboleth.sp.authn.impl.AgentSecretCredentialValidator"
p:id="spagent-internal" />
- <bean id="shibboleth.JAASValidator" parent="shibboleth.CredentialValidator"
- class="net.shibboleth.idp.authn.impl.JAASCredentialValidator" abstract="true"
- p:id="spagent-jaas" />
+ <!-- JAAS beans -->
- <bean id="shibboleth.KerberosValidator" parent="shibboleth.CredentialValidator"
- class="net.shibboleth.idp.authn.impl.KerberosCredentialValidator" abstract="true"
- p:id="spagent-krb5" />
-
- <bean id="shibboleth.LDAPValidator" parent="shibboleth.CredentialValidator" lazy-init="true"
- class="net.shibboleth.idp.authn.impl.LDAPCredentialValidator"
- p:id="spagent-ldap"
- p:authenticator-ref="shibboleth.authn.LDAP.authenticator" />
-
- <bean id="shibboleth.HTPasswdValidator" abstract="true"
+ <bean id="ParsedLoginConfigNames" parent="shibboleth.CommaDelimStringArray"
+ c:_0="#{'%{sp.agent.authn.JAAS.loginConfigNames:ShibSPAgentAuth}'.trim()}" />
+
+ <bean id="shibboleth.sp.JAASValidator" parent="shibboleth.sp.CredentialValidator" lazy-init="true"
+ class="net.shibboleth.idp.authn.impl.JAASCredentialValidator"
+ p:id="spagent-jaas"
+ p:loginConfigNames-ref="ParsedLoginConfigNames"
+ p:loginConfigType="JavaLoginConfig"
+ p:loginConfigResource="#{'%{sp.agent.authn.JAAS.loginConfig:%{idp.home}/conf/sp/jaas.config}'.trim()}" />
+
+ <!-- Kerberos beans -->
+
+ <bean id="shibboleth.sp.KerberosValidator" parent="shibboleth.sp.CredentialValidator" lazy-init="true"
+ class="net.shibboleth.idp.authn.impl.KerberosCredentialValidator"
+ p:id="spagent-krb5"
+ p:refreshKrb5Config="%{sp.agent.authn.Krb5.refreshConfig:false}"
+ p:preserveTicket="false"
+ p:servicePrincipal="#{'%{sp.agent.authn.Krb5.servicePrincipal:}'.trim()}"
+ p:keytabPath="#{'%{sp.agent.authn.Krb5.keytab:}'.trim()}" />
+
+ <!-- HTPasswd beans -->
+
+ <bean id="shibboleth.sp.HTPasswdValidator" abstract="true"
class="net.shibboleth.idp.authn.impl.HTPasswdCredentialValidator"
p:id="spagent-htpasswd" />
- <bean id="shibboleth.X509Validator" abstract="true"
+ <!-- X.509 beans -->
+
+ <bean id="shibboleth.sp.X509Validator" abstract="true"
class="net.shibboleth.idp.authn.impl.X509CertificateCredentialValidator"
p:id="spagent-x509" />
- <!-- Parent beans for custom ldaptive types. -->
+
+ <!-- LDAP beans -->
+
+ <bean id="shibboleth.sp.LDAPValidator" parent="shibboleth.sp.CredentialValidator" lazy-init="true"
+ class="net.shibboleth.idp.authn.impl.LDAPCredentialValidator"
+ p:id="spagent-ldap"
+ p:authenticator-ref="shibboleth.sp.authn.LDAP.authenticator" />
- <bean id="shibboleth.authn.LDAP.authenticator" parent="shibboleth.LDAPAuthenticationFactory"
+ <bean id="shibboleth.sp.authn.LDAP.authenticator" parent="shibboleth.sp.LDAPAuthenticationFactory"
lazy-init="true" />
- <bean id="shibboleth.X509ResourceCredentialConfig"
+ <bean id="shibboleth.sp.authn.LDAP.returnAttributes" parent="shibboleth.CommaDelimStringArray">
+ <constructor-arg type="java.lang.String" value="%{sp.agent.authn.LDAP.returnAttributes:1.1}" />
+ </bean>
+ <bean id="shibboleth.sp.X509ResourceCredentialConfig"
class="net.shibboleth.idp.authn.impl.X509ResourceCredentialConfig" abstract="true" />
- <bean id="shibboleth.KeystoreResourceCredentialConfig"
+ <bean id="shibboleth.sp.KeystoreResourceCredentialConfig"
class="net.shibboleth.idp.authn.impl.KeystoreResourceCredentialConfig" abstract="true" />
- <bean id="shibboleth.authn.LDAP.trustCertificates" parent="shibboleth.X509ResourceCredentialConfig"
+ <bean id="shibboleth.sp.authn.LDAP.trustCertificates" parent="shibboleth.sp.X509ResourceCredentialConfig"
p:trustCertificates="%{sp.agent.authn.LDAP.trustCertificates:undefined}" />
- <bean id="shibboleth.authn.LDAP.truststore" parent="shibboleth.KeystoreResourceCredentialConfig"
+ <bean id="shibboleth.sp.authn.LDAP.truststore" parent="shibboleth.sp.KeystoreResourceCredentialConfig"
p:truststore="%{sp.agent.authn.LDAP.trustStore:undefined}" />
- <bean id="shibboleth.LDAPAuthenticationFactory" abstract="true"
+ <bean id="shibboleth.sp.LDAPAuthenticationFactory" abstract="true"
class="net.shibboleth.idp.authn.config.LDAPAuthenticationFactoryBean"
p:authenticatorType="#{'%{sp.agent.authn.LDAP.authenticator:anonSearchAuthenticator}'.trim()}"
p:trustType="#{'%{sp.agent.authn.LDAP.sslConfig:certificateTrust}'.trim()}"
@@ -123,20 +146,20 @@
p:useStartTLS="%{sp.agent.authn.LDAP.useStartTLS:true}"
p:connectTimeout="%{sp.agent.authn.LDAP.connectTimeout:PT3S}"
p:responseTimeout="%{sp.agent.authn.LDAP.responseTimeout:PT3S}"
- p:trustCertificatesCredentialConfig-ref="shibboleth.authn.OAuth2Client.LDAP.trustCertificates"
- p:truststoreCredentialConfig-ref="shibboleth.authn.OAuth2Client.LDAP.truststore"
+ p:trustCertificatesCredentialConfig-ref="shibboleth.sp.authn.LDAP.trustCertificates"
+ p:truststoreCredentialConfig-ref="shibboleth.sp.authn.LDAP.truststore"
p:disablePooling="%{sp.agent.authn.LDAP.disablePooling:false}"
p:blockWaitTime="%{sp.agent.authn.pool.LDAP.blockWaitTime:PT3S}"
- p:minPoolSize="%{sp.agent.authn..pool.LDAP.minSize:3}"
- p:maxPoolSize="%{sp.agent.authn..pool.LDAP.maxSize:10}"
- p:validateOnCheckout="%{sp.agent.authn..pool.LDAP.validateOnCheckout:false}"
- p:validatePeriodically="%{sp.agent.authn..pool.LDAP.validatePeriodically:true}"
- p:validatePeriod="%{sp.agent.authn..pool.LDAP.validatePeriod:PT5M}"
- p:validateDn="#{'%{sp.agent.authn..pool.LDAP.validateDN:}'.trim()}"
- p:validateFilter="#{'%{sp.agent.authn..pool.LDAP.validateFilter:(objectClass=*)}'.trim()}"
+ p:minPoolSize="%{sp.agent.authn.pool.LDAP.minSize:3}"
+ p:maxPoolSize="%{sp.agent.authn.pool.LDAP.maxSize:10}"
+ p:validateOnCheckout="%{sp.agent.authn.pool.LDAP.validateOnCheckout:false}"
+ p:validatePeriodically="%{sp.agent.authn.pool.LDAP.validatePeriodically:true}"
+ p:validatePeriod="%{sp.agent.authn.pool.LDAP.validatePeriod:PT5M}"
+ p:validateDn="#{'%{sp.agent.authn.pool.LDAP.validateDN:}'.trim()}"
+ p:validateFilter="#{'%{sp.agent.authn.pool.LDAP.validateFilter:(objectClass=*)}'.trim()}"
p:bindPoolPassivatorType="#{'%{sp.agent.authn.LDAP.bindPoolPassivator:none}'.trim()}"
- p:prunePeriod="%{sp.agent.authn..pool.LDAP.prunePeriod:PT5M}"
- p:idleTime="%{sp.agent.authn..pool.LDAP.idleTime:PT10M}"
+ p:prunePeriod="%{sp.agent.authn.pool.LDAP.prunePeriod:PT5M}"
+ p:idleTime="%{sp.agent.authn.pool.LDAP.idleTime:PT10M}"
p:dnFormat="%{sp.agent.authn.LDAP.dnFormat:undefined}"
p:baseDn="#{'%{sp.agent.authn.LDAP.baseDN:undefined}'.trim()}"
p:userFilter="#{'%{sp.agent.authn.LDAP.userFilter:undefined}'.trim()}"
diff --git a/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/sp.properties b/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/sp.properties
index 1a3bcc0..0e6a4bf 100644
--- a/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/sp.properties
+++ b/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/sp.properties
@@ -10,16 +10,6 @@ sp.issuer = https://sp.example.org
#sp.service.agents.failFast = false
sp.service.agents.checkInterval = PT5M
-# For single agent hubs, set agent ID via property
-#sp.agentId = sp.example.org
-# Default agent IP address filter
-#sp.authn.allowedAddressRanges = 127.0.0.1/32, ::1/128
-# Set to empty value to skip shared secret authentication
-#sp.agent.authn.method = basic
-# Set false to globally disable cookie-based authentication by agents
-#sp.agent.authn.cached = true
-#sp.agent.authn.cacheDuration = PT1H
-
# Set to StorageService to use for remoted storage data if in use.
#sp.storageService = shibboleth.StorageService
# Set to DataSealer to use for remoted data encryption.
@@ -55,3 +45,88 @@ sp.service.agents.checkInterval = PT5M
# Uncomment/set to define a default IdP discovery service URL or Function
#sp.discoveryURL =
#sp.discoveryURLFunction =
+
+
+###############################
+# Agent Authentication Settings
+###############################
+
+# For single agent hubs, set agent ID via property
+#sp.agentId = sp.example.org
+# Default agent IP address filter
+#sp.authn.allowedAddressRanges = 127.0.0.1/32, ::1/128
+# Set to empty value to skip shared secret authentication
+#sp.agent.authn.method = basic
+# Set false to globally disable cookie-based authentication by agents
+#sp.agent.authn.cached = true
+#sp.agent.authn.cacheDuration = PT1H
+
+
+# Properties exist for optional "enterprise" agent secret validation. Most of them
+# are for LDAP, replicating the large range of properties available in the IdP "proper"
+# but kept separate for flexibility. They are "chained" to the IdP properties in most
+# cases for convenience but can be overridden if necessary.
+
+#sp.agent.authn.JAAS.loginConfigNames = ShibSPAgentAuth
+#sp.agent.authn.JAAS.loginConfig = %{idp.home}/conf/sp/jaas.config
+
+#sp.agent.authn.Krb5.servicePrincipal =
+#sp.agent.authn.Krb5.keytab =
+
+## Authenticator strategy,
+# either anonSearchAuthenticator, bindSearchAuthenticator, directAuthenticator, adAuthenticator
+#sp.agent.authn.LDAP.authenticator = %{idp.authn.LDAP.authenticator:anonSearchAuthenticator}
+
+## Connection properties ##
+#sp.agent.authn.LDAP.ldapURL = %{idp.authn.LDAP.ldapURL:ldap://localhost:10389}
+#sp.agent.authn.LDAP.useStartTLS = %{idp.authn.LDAP.useStartTLS:true}
+# Time to wait for startTLS responses
+#sp.agent.authn.LDAP.startTLSTimeout = %{idp.authn.LDAP.startTLSTimeout:PT3S}
+# Time to wait for connections to open
+#sp.agent.authn.LDAP.connectTimeout = %{idp.authn.LDAP.connectTimeout:PT3S}
+# Time to wait for operation responses (e.g. search, bind)
+#sp.agent.authn.LDAP.responseTimeout = %{idp.authn.LDAP.responseTimeout:PT3S}
+# Connection strategy to use when multiple URLs are supplied, either ACTIVE_PASSIVE, ROUND_ROBIN, RANDOM
+#sp.agent.authn.LDAP.connectionStrategy = %{idp.authn.LDAP.connectionStrategy:ACTIVE_PASSIVE}
+
+## SSL configuration, either jvmTrust, certificateTrust, or keyStoreTrust
+#sp.agent.authn.LDAP.sslConfig = %{idp.authn.LDAP.sslConfig:certificateTrust}
+## If using certificateTrust above, set to the trusted certificate's path
+#sp.agent.authn.LDAP.trustCertificates = %{idp.authn.LDAP.trustCertificates:%{idp.home}/credentials/ldap-server.crt}
+## If using keyStoreTrust above, set to the truststore path
+#sp.agent.authn.LDAP.trustStore = %{idp.authn.LDAP.trustStore:%{idp.home}/credentials/ldap-server.truststore}
+
+## Return attributes during authentication
+# Setting this property will cause entry resolution to occur as part of authentication
+# Note that this property is not compatible with the adAuthenticator
+#sp.agent.authn.LDAP.returnAttributes = %{idp.authn.LDAP.returnAttributes:1.1}
+
+## DN resolution properties ##
+
+# Search DN resolution, used by anonSearchAuthenticator, bindSearchAuthenticator
+# for AD: CN=Users,DC=example,DC=org
+#sp.agent.authn.LDAP.baseDN = %{idp.authn.LDAP.baseDN:ou=people,dc=example,dc=org}
+#sp.agent.authn.LDAP.subtreeSearch = %{idp.authn.LDAP.subtreeSearch:false}
+#sp.agent.authn.LDAP.userFilter = %{idp.authn.LDAP.userFilter:undefined}
+# bind search configuration
+# for AD: sp.agent.authn.LDAP.bindDN=adminuser at domain.com
+#sp.agent.authn.LDAP.bindDN = %{idp.authn.LDAP.bindDN:uid=myservice,ou=system}
+
+# Format DN resolution, used by directAuthenticator, adAuthenticator
+# for AD use sp.agent.authn.LDAP.dnFormat=%s at domain.com
+#sp.agent.authn.LDAP.dnFormat = %{idp.authn.LDAP.dnFormat:uid=%s,ou=people,dc=example,dc=org}
+
+# pool passivator, either none, bind or anonymousBind
+#sp.agent.authn.LDAP.bindPoolPassivator = %{idp.authn.LDAP.bindPoolPassivator:none}
+
+# LDAP pool configuration, used for both authn and DN resolution
+#sp.agent.authn.pool.LDAP.minSize = %{idp.authn.pool.LDAP.minSize:3}
+#sp.agent.authn.pool.LDAP.maxSize = %{idp.authn.pool.LDAP.maxSize:10}
+#sp.agent.authn.pool.LDAP.validateOnCheckout = %{idp.authn.pool.LDAP.validateOnCheckout:false}
+#sp.agent.authn.pool.LDAP.validatePeriodically = %{idp.authn.pool.LDAP.validatePeriodically:true}
+#sp.agent.authn.pool.LDAP.validatePeriod = %{idp.authn.pool.LDAP.validatePeriod:PT5M}
+#sp.agent.authn.pool.LDAP.validateDN = %{idp.authn.pool.LDAP.validateDN:}
+#sp.agent.authn.pool.LDAP.validateFilter = %{idp.authn.pool.LDAP.validateFilter:(objectClass=*)}
+#sp.agent.authn.pool.LDAP.prunePeriod = %{idp.authn.pool.LDAP.prunePeriod:PT5M}
+#sp.agent.authn.pool.LDAP.idleTime = %{idp.authn.pool.LDAP.idleTime:PT10M}
+#sp.agent.authn.pool.LDAP.blockWaitTime = %{idp.authn.pool.LDAP.blockWaitTime:PT3S}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list