[java-plugin-shibd-saml] branch main updated: Initial commit of new code for CredentialResolver service.

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-plugin-shibd-saml.

View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-saml/commit/a419402936b0888ffc24af6b53659dff5b38d23d

The following commit(s) were added to refs/heads/main by this push:
     new a419402  Initial commit of new code for CredentialResolver service.
a419402 is described below

commit a419402936b0888ffc24af6b53659dff5b38d23d
Author: Scott Cantor <scott at restingparrotsoftware.com>
AuthorDate: Thu Jul 23 11:57:49 2026 -0400

    Initial commit of new code for CredentialResolver service.
---
 sp-saml-impl/pom.xml                               |  6 +-
 .../impl/BasicSignatureSigningConfiguration.java   | 92 ++++++++++++++++++++++
 2 files changed, 97 insertions(+), 1 deletion(-)

diff --git a/sp-saml-impl/pom.xml b/sp-saml-impl/pom.xml
index 5767ec8..00b7dfa 100644
--- a/sp-saml-impl/pom.xml
+++ b/sp-saml-impl/pom.xml
@@ -98,12 +98,16 @@
             <artifactId>opensaml-saml-api</artifactId>
             <scope>provided</scope>
         </dependency>
-
         <dependency>
             <groupId>${opensaml.groupId}</groupId>
             <artifactId>opensaml-saml-impl</artifactId>
             <scope>provided</scope>
         </dependency>
+        <dependency>
+            <groupId>${opensaml.groupId}</groupId>
+            <artifactId>opensaml-xmlsec-impl</artifactId>
+            <scope>provided</scope>
+        </dependency>
         
         <dependency>
             <groupId>jakarta.servlet</groupId>
diff --git a/sp-saml-impl/src/main/java/net/shibboleth/sp/xmlsec/config/impl/BasicSignatureSigningConfiguration.java b/sp-saml-impl/src/main/java/net/shibboleth/sp/xmlsec/config/impl/BasicSignatureSigningConfiguration.java
new file mode 100644
index 0000000..419fa61
--- /dev/null
+++ b/sp-saml-impl/src/main/java/net/shibboleth/sp/xmlsec/config/impl/BasicSignatureSigningConfiguration.java
@@ -0,0 +1,92 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.sp.xmlsec.config.impl;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.saml.common.xml.SAMLConstants;
+import org.opensaml.saml.criterion.ProtocolCriterion;
+import org.opensaml.security.credential.Credential;
+import org.opensaml.security.credential.CredentialResolver;
+import org.opensaml.security.credential.UsageType;
+import org.opensaml.security.criteria.UsageCriterion;
+import org.slf4j.Logger;
+
+import net.shibboleth.shared.annotation.ParameterName;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
+import net.shibboleth.shared.resolver.CriteriaSet;
+import net.shibboleth.shared.resolver.ResolverException;
+
+/**
+ * Subclass of OpenSAML version to provide support for CredentialResolver service
+ * through a bridging class.
+ * 
+ * <p>This class currently assumes SAML protocol usage when resolving credentials.</p>
+ */
+public class BasicSignatureSigningConfiguration extends org.opensaml.xmlsec.impl.BasicSignatureSigningConfiguration {
+
+    /** Class logger. */
+    @Nonnull private final Logger log = LoggerFactory.getLogger(BasicSignatureSigningConfiguration.class);
+    
+    /** Bridge to resolve credentials. */
+    @Nonnull private final CredentialResolver credentialResolver;
+
+    /**
+     * Constructor.
+     *
+     * @param resolver a credential resolver service to use
+     */
+    public BasicSignatureSigningConfiguration(
+            @Nonnull @ParameterName(name="resolver") final CredentialResolver resolver) {
+        credentialResolver = Constraint.isNotNull(resolver, "CredentialResolver cannot be null");
+    }
+    
+    /** {@inheritDoc} */
+    @Override
+    @Nonnull @Unmodifiable @NotLive public List<Credential> getSigningCredentials() {
+        // TODO Auto-generated method stub
+        final List<Credential> hardwired = super.getSigningCredentials();
+        if (!hardwired.isEmpty()) {
+            return hardwired;
+        }
+        
+        // Resolve if possible using:
+        //  * UsageType = SIGNING
+        //  * Class = X509Credential
+        //  * Protocol = if set
+        
+        final CriteriaSet criteria = new CriteriaSet(new UsageCriterion(UsageType.SIGNING),
+                new ProtocolCriterion(SAMLConstants.SAML20P_NS));
+        
+        try {
+            final Iterable<Credential> creds = credentialResolver.resolve(criteria);
+            final ArrayList<Credential> accumulator = new ArrayList<>();
+            creds.forEach(accumulator::add);
+            return accumulator;
+        } catch (final ResolverException e) {
+            log.error("Exception resolving signing credentials", e);
+        }
+        
+        return CollectionSupport.emptyList();
+    }
+
+}
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.