[java-plugin-shibd-saml] branch main updated: Wiring in new Credential service along with default SAML keys/certs.
Codeberg
noreply at shibboleth.net
Mon Jul 27 14:12:05 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-plugin-shibd-saml.
View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-saml/commit/07218035b3a3c307971774d1da91daef4d091033
The following commit(s) were added to refs/heads/main by this push:
new 0721803 Wiring in new Credential service along with default SAML keys/certs.
0721803 is described below
commit 07218035b3a3c307971774d1da91daef4d091033
Author: Scott Cantor <scott at restingparrotsoftware.com>
AuthorDate: Mon Jul 27 10:11:53 2026 -0400
Wiring in new Credential service along with default SAML keys/certs.
---
.../net/shibboleth/sp/service/agent/postconfig.xml | 65 ++++++++++++----------
.../sp/service/credentials/postconfig.xml | 40 +++++++++++++
.../idp/module/conf/sp/saml-credentials.xml | 63 ---------------------
.../net/shibboleth/sp/saml/conf/module.properties | 3 -
.../net/shibboleth/idp/module/conf/sp/agents.xml | 2 -
.../idp/module/conf/sp/saml-test-agents.xml | 2 -
.../shibboleth/idp/module/conf/sp/sp.properties | 8 ++-
.../sp/xmlsec/config/impl/package-info.java | 18 ++++++
8 files changed, 101 insertions(+), 100 deletions(-)
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml
index 1136d01..1a25896 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml
@@ -40,19 +40,6 @@
</property>
</bean>
- <!--
- Auto-wiring exposers for credentials to get them loaded into the agent resolver.
- The qualifiers control which auto-wiring point is used.
- -->
- <bean class="net.shibboleth.spring.security.CredentialHolder"
- c:_0="#{getObject('shibboleth.sp.SigningCredentials')}">
- <qualifier value="signing"/>
- </bean>
- <bean class="net.shibboleth.spring.security.CredentialHolder"
- c:_0="#{getObject('shibboleth.sp.EncryptionCredentials')}">
- <qualifier value="encryption"/>
- </bean>
-
<!--
Default Profile Configurations, also usable as parent beans in overrides.
@@ -100,8 +87,8 @@
<!--
Security Configuration Defaults
- These settings establish the default security configurations for signatures and encryption
- and loads the default credentials used.
+ These settings establish the default security configurations for signatures and encryption.
+ Credentials are now pulled from resolver service via bridge installed in parent beans or below.
-->
<bean id="shibboleth.sp.DefaultXMLSecurityConfiguration" class="org.opensaml.xmlsec.config.BasicXMLSecurityConfiguration">
@@ -120,9 +107,12 @@
</property>
<property name="httpClientSecurityConfiguration">
- <bean parent="shibboleth.BasicHttpClientSecurityConfiguration"
- p:clientTLSCredential="#{getObject('shibboleth.sp.DefaultClientTLSCredential')}"
- p:TLSTrustEngine-ref="#{'%{sp.saml.trust.httpClient.tls:shibboleth.sp.ExplicitKeyX509TrustEngine}'.trim()}" />
+ <bean parent="shibboleth.sp.BasicHttpClientSecurityConfiguration"
+ p:TLSTrustEngine-ref="#{'%{sp.saml.trust.httpClient.tls:shibboleth.sp.ExplicitKeyX509TrustEngine}'.trim()}">
+ <property name="protocol">
+ <util:constant static-field="org.opensaml.saml.common.xml.SAMLConstants.SAML20P_NS" />
+ </property>
+ </bean>
</property>
<property name="encryptionConfiguration">
@@ -181,8 +171,11 @@
<!-- Actual signing configurations for SHA-256 and SHA-1. -->
- <bean id="shibboleth.sp.SigningConfiguration.SHA256" parent="shibboleth.BasicSignatureSigningConfiguration"
- p:signingCredentials-ref="shibboleth.sp.DefaultSigningCredential"
+ <bean id="shibboleth.sp.BasicSignatureSigningConfiguration" parent="shibboleth.BasicSignatureSigningConfiguration"
+ class="net.shibboleth.sp.xmlsec.config.impl.BasicSignatureSigningConfiguration"
+ c:resolver-ref="shibboleth.sp.CredentialResolverBridge" />
+
+ <bean id="shibboleth.sp.SigningConfiguration.SHA256" parent="shibboleth.sp.BasicSignatureSigningConfiguration"
p:keyInfoGeneratorManager-ref="NamedKeyInfoGeneratorManager">
<property name="signatureAlgorithms">
<list>
@@ -200,8 +193,7 @@
</property>
</bean>
- <bean id="shibboleth.sp.SigningConfiguration.SHA1" parent="shibboleth.BasicSignatureSigningConfiguration"
- p:signingCredentials-ref="shibboleth.sp.DefaultSigningCredential"
+ <bean id="shibboleth.sp.SigningConfiguration.SHA1" parent="shibboleth.sp.BasicSignatureSigningConfiguration"
p:keyInfoGeneratorManager-ref="NamedKeyInfoGeneratorManager">
<property name="signatureAlgorithms">
<list>
@@ -319,15 +311,31 @@
</constructor-arg>
</bean>
+ <!-- This bridges the bean below that resolves decryption keys into our service while adding needed criteria. -->
+ <bean id="localDecryptionKEKResolver" class="net.shibboleth.sp.credential.impl.StaticCriterionCredentialResolver"
+ c:resolver-ref="shibboleth.sp.CredentialResolverBridge">
+ <constructor-arg name="criteria">
+ <set>
+ <bean class="org.opensaml.security.criteria.UsageCriterion">
+ <constructor-arg>
+ <util:constant static-field="org.opensaml.security.credential.UsageType.ENCRYPTION" />
+ </constructor-arg>
+ </bean>
+ <bean class="org.opensaml.saml.criterion.ProtocolCriterion">
+ <constructor-arg>
+ <util:constant static-field="org.opensaml.saml.common.xml.SAMLConstants.SAML20P_NS" />
+ </constructor-arg>
+ </bean>
+ </set>
+ </constructor-arg>
+ </bean>
+
<!-- Defines decryption keys, along with support for optimizing lookup based on KeyInfo hints. -->
<bean id="defaultKeyEncryptionCredentialResolver" class="org.opensaml.xmlsec.keyinfo.impl.ChainingKeyInfoCredentialResolver">
<constructor-arg>
<list>
- <bean class="org.opensaml.xmlsec.keyinfo.impl.LocalKeyInfoCredentialResolver">
- <constructor-arg name="localCredentialResolver">
- <bean class="org.opensaml.xmlsec.keyinfo.impl.CollectionKeyInfoCredentialResolver"
- c:credentials-ref="shibboleth.sp.DefaultEncryptionCredentials" />
- </constructor-arg>
+ <bean class="org.opensaml.xmlsec.keyinfo.impl.LocalKeyInfoCredentialResolver"
+ c:localCredentialResolver-ref="localDecryptionKEKResolver">
<constructor-arg name="keyInfoProviders">
<list>
<bean class="org.opensaml.xmlsec.keyinfo.impl.provider.RSAKeyValueProvider" />
@@ -339,8 +347,7 @@
</list>
</constructor-arg>
</bean>
- <bean class="org.opensaml.xmlsec.keyinfo.impl.StaticKeyInfoCredentialResolver"
- c:credentials-ref="shibboleth.sp.DefaultEncryptionCredentials" />
+ <ref bean="localDecryptionKEKResolver" />
</list>
</constructor-arg>
</bean>
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/credentials/postconfig.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/credentials/postconfig.xml
new file mode 100644
index 0000000..fad36e6
--- /dev/null
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/credentials/postconfig.xml
@@ -0,0 +1,40 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:context="http://www.springframework.org/schema/context"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:c="http://www.springframework.org/schema/c"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+
+ default-init-method="initialize"
+ default-destroy-method="destroy">
+
+ <!-- Installs a "default" set of SAML credentials into the resolver service. -->
+
+ <bean id="shibboleth.sp.saml.DefaultCredentialResolver" class="net.shibboleth.sp.credential.impl.StaticCredentialResolver"
+ c:_0="#{getObject('shibboleth.sp.saml.DefaultCredentials') ?: getObject('DefaultCredentials')}">
+ <property name="protocols">
+ <util:constant static-field="org.opensaml.saml.common.xml.SAMLConstants.SAML20P_NS" />
+ </property>
+ </bean>
+
+ <bean id="DefaultCredentials" class="org.springframework.beans.factory.config.ListFactoryBean" lazy-init="true">
+ <property name="sourceList">
+ <list>
+ <bean parent="shibboleth.BasicX509CredentialFactoryBean"
+ p:usageType="SIGNING"
+ p:privateKeyResource="%{sp.saml.signing.key}"
+ p:certificateResource="%{sp.saml.signing.cert}" />
+
+ <bean parent="shibboleth.BasicX509CredentialFactoryBean"
+ p:usageType="ENCRYPTION"
+ p:privateKeyResource="%{sp.saml.encryption.key}"
+ p:certificateResource="%{sp.saml.encryption.cert}" />
+ </list>
+ </property>
+ </bean>
+
+</beans>
diff --git a/sp-saml-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/saml-credentials.xml b/sp-saml-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/saml-credentials.xml
deleted file mode 100644
index bb6084f..0000000
--- a/sp-saml-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/saml-credentials.xml
+++ /dev/null
@@ -1,63 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
- xmlns:context="http://www.springframework.org/schema/context"
- xmlns:util="http://www.springframework.org/schema/util"
- xmlns:p="http://www.springframework.org/schema/p"
- xmlns:c="http://www.springframework.org/schema/c"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-
- default-init-method="initialize"
- default-destroy-method="destroy">
-
- <!--
- This defines the signing and encryption key and certificate pairs referenced by your agent/application
- configuration. You don't normally need to touch this, unless you have advanced requirements such as
- supporting multiple sets of keys for different IdPs, in which case you may want to define all your
- credentials here for convenience and reference them as needed.
- -->
-
- <!--
- The list of ALL of your SP's' signing credentials. If you define additional signing credentials,
- for example for specific relying parties or different key types, make sure to include them within this list.
- -->
- <util:list id="shibboleth.sp.SigningCredentials">
- <ref bean="shibboleth.sp.DefaultSigningCredential" />
- </util:list>
-
- <!-- Your SP's default signing key, set via property file. -->
- <bean id="shibboleth.sp.DefaultSigningCredential" parent="shibboleth.BasicX509CredentialFactoryBean"
- p:privateKeyResource="%{sp.saml.signing.key}"
- p:certificateResource="%{sp.saml.signing.cert}" />
-
- <!-- Your SPs default client TLS credential, by default the same as the default signing credential. -->
- <alias alias="shibboleth.sp.DefaultClientTLSCredential" name="shibboleth.sp.DefaultSigningCredential" />
-
- <!--
- The list of ALL of your SP's' encryption credentials. By default this is just an alias
- for 'shibboleth.DefaultEncryptionCredentials'. It could be re-defined as
- a list with additional credentials if needed.
- -->
- <alias alias="shibboleth.sp.EncryptionCredentials" name="shibboleth.sp.DefaultEncryptionCredentials" />
-
- <!-- Your SP's default encryption (really decryption) keys, set via property file. -->
- <util:list id="shibboleth.sp.DefaultEncryptionCredentials">
-
- <bean parent="shibboleth.BasicX509CredentialFactoryBean"
- p:privateKeyResource="%{sp.saml.encryption.key}"
- p:certificateResource="%{sp.saml.encryption.cert}" />
-
- <!--
- For key rollover, uncomment and point to your original keypair, and use the one above
- to point to your new keypair. Once metadata has propagated, comment this one out again.
- -->
- <!--
- <bean parent="shibboleth.BasicX509CredentialFactoryBean"
- p:privateKeyResource="%{sp.saml.encryption.key.2}"
- p:certificateResource="%{sp.saml.encryption.cert.2}" />
- -->
- </util:list>
-
-</beans>
diff --git a/sp-saml-conf-impl/src/main/resources/net/shibboleth/sp/saml/conf/module.properties b/sp-saml-conf-impl/src/main/resources/net/shibboleth/sp/saml/conf/module.properties
index 15fb704..e08ab12 100644
--- a/sp-saml-conf-impl/src/main/resources/net/shibboleth/sp/saml/conf/module.properties
+++ b/sp-saml-conf-impl/src/main/resources/net/shibboleth/sp/saml/conf/module.properties
@@ -12,6 +12,3 @@ sp.SAML.url = https://shibboleth.atlassian.net/wiki/spaces/sphub1
sp.SAML.1.src = /net/shibboleth/idp/module/conf/sp/saml.properties
sp.SAML.1.dest = conf/sp/saml.properties
-
-sp.SAML.2.src = /net/shibboleth/idp/module/conf/sp/saml-credentials.xml
-sp.SAML.2.dest = conf/sp/saml-credentials.xml
diff --git a/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/agents.xml b/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/agents.xml
index 322a8b6..376677c 100644
--- a/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/agents.xml
+++ b/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/agents.xml
@@ -59,7 +59,5 @@
<util:list id="shibboleth.sp.UnverifiedProfileConfigurations">
</util:list>
-->
-
- <import resource="saml-credentials.xml" />
</beans>
diff --git a/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/saml-test-agents.xml b/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/saml-test-agents.xml
index efeaa7c..8ed9eed 100644
--- a/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/saml-test-agents.xml
+++ b/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/saml-test-agents.xml
@@ -16,8 +16,6 @@
This file is used in the sp-saml-conf-impl unit tests by overriding the AgentResolver service resources.
-->
- <import resource="saml-credentials.xml" />
-
<bean p:id="testsp.example.org" parent="shibboleth.sp.Agent" p:credentials="#{ {null : 'foo'} }"
p:issuer="https://testsp.example.org">
<property name="applications">
diff --git a/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/sp.properties b/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/sp.properties
index f5395be..6537428 100644
--- a/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/sp.properties
+++ b/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/sp.properties
@@ -4,7 +4,7 @@ sp.issuer = https://sp.example.org
# Default authentication authority (IdP, OP, etc.) to use if any
sp.defaultAuthority = https://idp.example.org
-# Controls configuration of service to resolve SP agents and applications
+# Configuration of service to resolve SP agents and applications
# Uncomment and define to override service resources
#sp.service.agents.resources = shibboleth.sp.AgentResolverResources
#sp.service.agents.failFast = false
@@ -12,6 +12,12 @@ sp.service.agents.checkInterval = PT5M
# Set to true for defaulted profile configs to be metadata-driven/aware
#sp.service.agents.useMetadataDrivenProfiles = false
+# Configuration of service to resolve SP credentials and secrets
+# Uncomment and define to override service resources
+#sp.service.credential.resources = shibboleth.sp.CredentialResolverResources
+#sp.service.credential.failFast = false
+sp.service.credential.checkInterval = PT5M
+
# General SP cookie properties
#sp.cookie.secure = true
#sp.cookie.httpOnly = true
diff --git a/sp-saml-impl/src/main/java/net/shibboleth/sp/xmlsec/config/impl/package-info.java b/sp-saml-impl/src/main/java/net/shibboleth/sp/xmlsec/config/impl/package-info.java
new file mode 100644
index 0000000..9839af9
--- /dev/null
+++ b/sp-saml-impl/src/main/java/net/shibboleth/sp/xmlsec/config/impl/package-info.java
@@ -0,0 +1,18 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * SP classes for SAML/XML security configuration.
+ */
+package net.shibboleth.sp.xmlsec.config.impl;
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list