[java-idp-plugin-jetty] 16/186: IDP-1110 - Add backchannel

[Rod Widdowson]

This is an automated email from the git hooks/post-receive script.

rdw pushed a commit to branch dev/foo
in repository java-idp-plugin-jetty.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-jetty.git;a=commit;h=2b9b471a0b6d0fd22b3ee30e0763eb493e21ae94

commit 2b9b471a0b6d0fd22b3ee30e0763eb493e21ae94
Author: Tom Zeller <tzeller at dragonacea.biz>
AuthorDate: Wed Jun 14 16:38:42 2017 -0500

    IDP-1110 - Add backchannel
---
 .../resources/jetty-base/etc/idp-backchannel.xml   | 89 ++++++++++++++++++++++
 .../jetty-base/modules/idp-backchannel.mod         |  8 ++
 .../jetty-base/start.d/idp-backchannel.ini         | 11 +++
 3 files changed, 108 insertions(+)

diff --git a/src/main/resources/jetty-base/etc/idp-backchannel.xml b/src/main/resources/jetty-base/etc/idp-backchannel.xml
new file mode 100644
index 0000000..9f19c95
--- /dev/null
+++ b/src/main/resources/jetty-base/etc/idp-backchannel.xml
@@ -0,0 +1,89 @@
+<?xml version="1.0"?>
+<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "http://www.eclipse.org/jetty/configure_9_0.dtd">
+ 
+<Configure id="Server" class="org.eclipse.jetty.server.Server">
+  
+ <!-- ============================================================= -->
+  <!-- TLS context factory with optional client auth                 -->
+  <!-- and no container trust (delegate to application)              -->
+  <!-- for backchannel (SOAP) communication to IdP                   -->
+  <!-- ============================================================= -->
+  <New id="shibContextFactory" class="net.shibboleth.utilities.jetty9.DelegateToApplicationSslContextFactory">
+    <Set name="KeyStorePath"><Property name="jetty.backchannel.keystore.path" /></Set>
+    <Set name="KeyStoreType"><Property name="jetty.backchannel.keystore.type" /></Set>
+    <Set name="KeyStorePassword"><Property name="jetty.backchannel.keystore.password" /></Set>
+    <!-- This is a tweak to work around a bug in Jetty when using the PKCS12 keystore type. -->
+    <Set name="TrustStoreType"><Property name="jetty.backchannel.keystore.type" /></Set>
+    <Set name="EndpointIdentificationAlgorithm"></Set>
+    <Set name="renegotiationAllowed">false</Set>
+    <Set name="useCipherSuitesOrder">true</Set>
+    <Set name="excludeProtocols">
+      <Array type="String">
+        <Item>SSL</Item>
+        <Item>SSLv2</Item>
+        <Item>SSLv3</Item>
+      </Array>
+    </Set>
+    <Set name="IncludeCipherSuites">
+      <Array type="String">
+          <Item>TLS_ECDHE.*</Item>
+          <Item>TLS_RSA.*</Item>
+      </Array>
+    </Set>
+    <Set name="ExcludeCipherSuites">
+      <Array type="String">
+        <Item>.*NULL.*</Item>
+        <Item>.*RC4.*</Item>
+        <Item>.*MD5.*</Item>
+        <Item>.*DES.*</Item>
+        <Item>.*DSS.*</Item>
+      </Array>
+    </Set>
+  </New>
+ 
+  <New id="shibHttpConfig" class="org.eclipse.jetty.server.HttpConfiguration">
+    <Arg><Ref refid="httpConfig"/></Arg>
+    <Call name="addCustomizer">
+      <Arg>
+        <New class="org.eclipse.jetty.server.SecureRequestCustomizer">
+          <Arg type="boolean"><Property name="jetty.ssl.sniHostCheck" default="true"/></Arg>
+        </New>
+      </Arg>
+    </Call>
+  </New>
+ 
+  <!-- ============================================================= -->
+  <!-- IdP SOAP protocol connector                                   -->
+  <!-- ============================================================= -->
+  <Call id="shibConnector" name="addConnector">
+    <Arg>
+      <New class="org.eclipse.jetty.server.ServerConnector">
+        <Arg name="server"><Ref refid="Server" /></Arg>
+        <Arg name="acceptors" type="int"><Property name="jetty.ssl.acceptors" default="-1"/></Arg>
+        <Arg name="selectors" type="int"><Property name="jetty.ssl.selectors" default="-1"/></Arg>
+        <Arg name="factories">
+          <Array type="org.eclipse.jetty.server.ConnectionFactory">
+            <Item>
+              <New class="org.eclipse.jetty.server.SslConnectionFactory">
+                <Arg name="next">http/1.1</Arg>
+                <Arg name="sslContextFactory"><Ref refid="shibContextFactory"/></Arg>
+              </New>
+            </Item>
+            <Item>
+              <New class="org.eclipse.jetty.server.HttpConnectionFactory">
+                <Arg name="config"><Ref refid="shibHttpConfig"/></Arg>
+              </New>
+            </Item>
+          </Array>
+        </Arg>
+        <Set name="host"><Property name="jetty.backchannel.host" default="0.0.0.0" /></Set>
+        <Set name="port"><Property name="jetty.backchannel.port" default="8443"/></Set>
+        <Set name="idleTimeout"><Property name="jetty.ssl.timeout" default="30000"/></Set>
+        <Set name="soLingerTime"><Property name="jetty.ssl.soLingerTime" default="-1"/></Set>
+        <Set name="acceptorPriorityDelta"><Property name="jetty.ssl.acceptorPriorityDelta" default="0"/></Set>
+        <Set name="acceptQueueSize"><Property name="jetty.ssl.acceptQueueSize" default="0"/></Set>
+      </New>
+    </Arg>
+  </Call>
+ 
+</Configure>
diff --git a/src/main/resources/jetty-base/modules/idp-backchannel.mod b/src/main/resources/jetty-base/modules/idp-backchannel.mod
new file mode 100644
index 0000000..7cfce50
--- /dev/null
+++ b/src/main/resources/jetty-base/modules/idp-backchannel.mod
@@ -0,0 +1,8 @@
+[description]
+Shibboleth IdP Back-Channel
+ 
+[depend]
+idp
+ 
+[xml]
+etc/idp-backchannel.xml
diff --git a/src/main/resources/jetty-base/start.d/idp-backchannel.ini b/src/main/resources/jetty-base/start.d/idp-backchannel.ini
new file mode 100644
index 0000000..64dfa8e
--- /dev/null
+++ b/src/main/resources/jetty-base/start.d/idp-backchannel.ini
@@ -0,0 +1,11 @@
+# --------------------------------------- 
+# Module: idp-logging
+# Shibboleth IdP Logging
+# --------------------------------------- 
+--module=idp-backchannel
+
+jetty.backchannel.host=0.0.0.0
+jetty.backchannel.port=9443
+jetty.backchannel.keystore.path=${idp.home}/credentials/idp-backchannel.p12
+jetty.backchannel.keystore.password=changeit
+jetty.backchannel.keystore.type=PKCS12

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.