[java-plugin-shibd-saml] branch main updated: Rename default keypair files and add generation to module enable step.
Codeberg
noreply at shibboleth.net
Tue Jul 28 13:41:00 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-plugin-shibd-saml.
View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-saml/commit/00cca840b7d18f898641d93706c03d06dba9a84e
The following commit(s) were added to refs/heads/main by this push:
new 00cca84 Rename default keypair files and add generation to module enable step.
00cca84 is described below
commit 00cca840b7d18f898641d93706c03d06dba9a84e
Author: Scott Cantor <scott at restingparrotsoftware.com>
AuthorDate: Tue Jul 28 09:40:49 2026 -0400
Rename default keypair files and add generation to module enable step.
---
sp-saml-conf-impl/pom.xml | 6 ++
.../net/shibboleth/sp/saml/conf/SAMLModule.java | 77 +++++++++++++++++++++-
.../shibboleth/idp/module/conf/sp/saml.properties | 15 ++---
.../flows/saml2/SAML2LogoutInitiatorFlowTest.java | 7 ++
...-encryption.crt => saml-default-encryption.crt} | 0
...-encryption.key => saml-default-encryption.key} | 0
.../{sp-signing.crt => saml-default-signing.crt} | 0
.../{sp-signing.key => saml-default-signing.key} | 0
8 files changed, 95 insertions(+), 10 deletions(-)
diff --git a/sp-saml-conf-impl/pom.xml b/sp-saml-conf-impl/pom.xml
index 3b2947d..a298232 100644
--- a/sp-saml-conf-impl/pom.xml
+++ b/sp-saml-conf-impl/pom.xml
@@ -40,6 +40,12 @@
<scope>provided</scope>
</dependency>
+ <dependency>
+ <groupId>${idp.groupId}</groupId>
+ <artifactId>idp-installer</artifactId>
+ <scope>provided</scope>
+ </dependency>
+
<!-- For audit beans. -->
<dependency>
<groupId>${idp.groupId}</groupId>
diff --git a/sp-saml-conf-impl/src/main/java/net/shibboleth/sp/saml/conf/SAMLModule.java b/sp-saml-conf-impl/src/main/java/net/shibboleth/sp/saml/conf/SAMLModule.java
index 307cb7d..7a05cce 100644
--- a/sp-saml-conf-impl/src/main/java/net/shibboleth/sp/saml/conf/SAMLModule.java
+++ b/sp-saml-conf-impl/src/main/java/net/shibboleth/sp/saml/conf/SAMLModule.java
@@ -15,16 +15,44 @@
package net.shibboleth.sp.saml.conf;
import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.Map;
+import javax.annotation.Nonnull;
+
+import org.slf4j.Logger;
+
+import net.shibboleth.idp.installer.InstallerSupport;
+import net.shibboleth.idp.installer.InstallerProperties;
import net.shibboleth.idp.module.IdPModule;
import net.shibboleth.idp.module.impl.PluginIdPModule;
+import net.shibboleth.profile.module.ModuleContext;
import net.shibboleth.profile.module.ModuleException;
+import net.shibboleth.shared.collection.CollectionSupport;
+import net.shibboleth.shared.primitive.LoggerFactory;
+import net.shibboleth.shared.security.impl.SelfSignedCertificateGenerator;
/**
* {@link IdPModule} implementation.
*/
public final class SAMLModule extends PluginIdPModule {
+ /** Default value of property naming signing key. */
+ @Nonnull public static final String DEFAULT_SIGNING_KEY_FILENAME = "saml-default-signing.key";
+
+ /** Default value of property naming signing cert. */
+ @Nonnull public static final String DEFAULT_SIGNING_CERT_FILENAME = "saml-default-signing.crt";
+
+ /** Default value of property naming encryption key. */
+ @Nonnull public static final String DEFAULT_ENCRYPTION_KEY_FILENAME = "saml-default-encryption.key";
+
+ /** Default value of property naming encryption cert. */
+ @Nonnull public static final String DEFAULT_ENCRYPTION_CERT_FILENAME = "saml-default-encryption.crt";
+
+ /** Class logger. */
+ @Nonnull private Logger log = LoggerFactory.getLogger(SAMLModule.class);
+
/**
* Constructor.
*
@@ -35,4 +63,51 @@ public final class SAMLModule extends PluginIdPModule {
super(Version.getVersion(), SAMLModule.class);
}
-}
+ /** {@inheritDoc} */
+ @Override
+ @Nonnull public Map<ModuleResource, ResourceResult> enable(@Nonnull final ModuleContext moduleContext) throws ModuleException {
+ final Map<ModuleResource, ResourceResult> result = super.enable(moduleContext);
+
+ final Path idpHome = Path.of(moduleContext.getInstallLocation());
+
+ final Path signingKey = idpHome.resolve("credentials").resolve("sp").resolve(DEFAULT_SIGNING_KEY_FILENAME);
+ if (!Files.exists(signingKey)) {
+ generateKeyPair(signingKey, idpHome.resolve("credentials").resolve("sp").resolve(DEFAULT_SIGNING_CERT_FILENAME));
+ }
+
+ final Path encryptionKey = idpHome.resolve("credentials").resolve("sp").resolve(DEFAULT_ENCRYPTION_KEY_FILENAME);
+ if (!Files.exists(encryptionKey)) {
+ generateKeyPair(encryptionKey, idpHome.resolve("credentials").resolve("sp").resolve(DEFAULT_ENCRYPTION_CERT_FILENAME));
+ }
+
+ return result;
+ }
+
+ /**
+ * Generate a keypair.
+ *
+ * @param keyFile where to put the key file
+ * @param crtFile where to put the crt file
+ *
+ * @throws ModuleException if the generator fails
+ */
+ private void generateKeyPair(@Nonnull final Path keyFile, @Nonnull final Path crtFile) throws ModuleException {
+ final SelfSignedCertificateGenerator generator = new SelfSignedCertificateGenerator();
+ generator.setCertificateFile(crtFile.toFile());
+ generator.setKeySize(InstallerProperties.DEFAULT_KEY_SIZE);
+ final String hostName = InstallerSupport.getBestHostName();
+ generator.setHostName(hostName);
+ final String altName = "https://" + hostName + "/sp";
+ generator.setURISubjectAltNames(CollectionSupport.singletonList(altName));
+ log.info("Creating {}/{} CN = {} URI = {}, keySize={}",
+ keyFile, crtFile, hostName, altName, InstallerProperties.DEFAULT_KEY_SIZE);
+
+ try {
+ generator.generate();
+ } catch (final Exception e) {
+ log.error("Error generating default keypair", e);
+ throw new ModuleException("Error generating default keypair.", e);
+ }
+ }
+
+}
\ No newline at end of file
diff --git a/sp-saml-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/saml.properties b/sp-saml-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/saml.properties
index f0706be..194545a 100644
--- a/sp-saml-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/saml.properties
+++ b/sp-saml-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/saml.properties
@@ -1,14 +1,11 @@
# SAML-specific SP settings
-# Settings for SP public/private signing and encryption key(s)
-# During decryption key rollover, point the ".2" properties at a second
-# keypair, uncomment in credentials.xml, then publish it in your metadata.
-sp.saml.signing.key = %{idp.home}/credentials/sp/sp-signing.key
-sp.saml.signing.cert = %{idp.home}/credentials/sp/sp-signing.crt
-sp.saml.encryption.key = %{idp.home}/credentials/sp/sp-encryption.key
-sp.saml.encryption.cert = %{idp.home}/credentials/sp/sp-encryption.crt
-#sp.saml.encryption.key.2 = %{idp.home}/credentials/sp/sp-encryption-old.key
-#sp.saml.encryption.cert.2 = %{idp.home}/credentials/sp/sp-encryption-old.crt
+# Settings for default SAML public/private signing and encryption key(s)
+# These can be replaced, supplemented, defined per-Agent, etc., see docs.
+sp.saml.signing.key = %{idp.home}/credentials/sp/saml-default-signing.key
+sp.saml.signing.cert = %{idp.home}/credentials/sp/saml-default-signing.crt
+sp.saml.encryption.key = %{idp.home}/credentials/sp/saml-default-encryption.key
+sp.saml.encryption.cert = %{idp.home}/credentials/sp/saml-default-encryption.crt
# Global profile defaults
#sp.saml.encryption.optional = true
diff --git a/sp-saml-conf-impl/src/test/java/net/shibboleth/sp/saml/flows/saml2/SAML2LogoutInitiatorFlowTest.java b/sp-saml-conf-impl/src/test/java/net/shibboleth/sp/saml/flows/saml2/SAML2LogoutInitiatorFlowTest.java
index 478c2fd..7d4f429 100644
--- a/sp-saml-conf-impl/src/test/java/net/shibboleth/sp/saml/flows/saml2/SAML2LogoutInitiatorFlowTest.java
+++ b/sp-saml-conf-impl/src/test/java/net/shibboleth/sp/saml/flows/saml2/SAML2LogoutInitiatorFlowTest.java
@@ -319,6 +319,7 @@ public class SAML2LogoutInitiatorFlowTest extends AbstractSPFlowTest {
final Object saml = prc.ensureOutboundMessageContext().ensureMessage();
assert saml instanceof LogoutRequest;
logoutRequest = (LogoutRequest) saml;
+ Assert.assertTrue(logoutRequest.isSigned());
}
assert logoutRequest != null;
@@ -385,6 +386,9 @@ public class SAML2LogoutInitiatorFlowTest extends AbstractSPFlowTest {
if (url == null || index < 0) {
throw new MessageDecodingException("No query string");
}
+
+ mock.setQueryString(url.substring(index + 1));
+
final List<Pair<String,String>> params = URISupport.parseQueryString(url.substring(index + 1));
for (final var param : params) {
final String name = param.getFirst();
@@ -392,6 +396,9 @@ public class SAML2LogoutInitiatorFlowTest extends AbstractSPFlowTest {
mock.addParameter(name, param.getSecond());
}
}
+
+ Assert.assertNotNull(mock.getParameter("SAMLRequest"));
+ Assert.assertNotNull(mock.getParameter("Signature"));
final HTTPRedirectDeflateDecoder decoder = new HTTPRedirectDeflateDecoder();
decoder.setHttpServletRequestSupplier(NonnullSupplier.of(mock));
diff --git a/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/credentials/sp/sp-encryption.crt b/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/credentials/sp/saml-default-encryption.crt
similarity index 100%
rename from sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/credentials/sp/sp-encryption.crt
rename to sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/credentials/sp/saml-default-encryption.crt
diff --git a/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/credentials/sp/sp-encryption.key b/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/credentials/sp/saml-default-encryption.key
similarity index 100%
rename from sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/credentials/sp/sp-encryption.key
rename to sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/credentials/sp/saml-default-encryption.key
diff --git a/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/credentials/sp/sp-signing.crt b/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/credentials/sp/saml-default-signing.crt
similarity index 100%
rename from sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/credentials/sp/sp-signing.crt
rename to sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/credentials/sp/saml-default-signing.crt
diff --git a/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/credentials/sp/sp-signing.key b/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/credentials/sp/saml-default-signing.key
similarity index 100%
rename from sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/credentials/sp/sp-signing.key
rename to sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/credentials/sp/saml-default-signing.key
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list