IdP credentials for delegation Assertion signature validation

[Brent Putman]

On 8/20/15 10:52 PM, Brent Putman wrote:
>
>
> On 8/20/15 10:00 PM, Brent Putman wrote:
>>
>>
>> <util:list id="shibboleth.DefaultSigningCredentials">
>>     <bean id="shibboleth.DefaultSigningCredential"
>>          
>> class="net.shibboleth.idp.profile.spring.factory.BasicX509CredentialFactoryBean"
>>           p:privateKeyResource="%{idp.signing.key}"
>>           p:certificateResource="%{idp.signing.cert}"
>>           p:entityId-ref="entityID" />
>> </util:list>
>
>
> Btw, to be clear, it wouldn't probably be called
> shibboleth.DefaultSigningCredentials (not -Default-), since it needs
> to be all of them.


Hmmm, this bean syntax turns out to not work.  I thought that beans
defined inside a util:list or other util: collections were still
directly referenceable by bean name as long as they carried an 'id'
attribute, but the above does not seem to work, i.e. some other wiring
of security config spits errors on start that it can't find the bean
named shibboleth.DefaultSigningCredential.    I've searched a bit, I
can't find a definitive answer yet.  Does anyone else happen to know
one way or another?

For now, I punted and just defined the list like so, leaving the
existing credential as a "top-level" bean:


    <util:list id="shibboleth.SigningCredentials">
        <ref bean="shibboleth.DefaultSigningCredential" />
    </util:list>


I don't know, maybe that's a cleaner syntax anyway, and would be easier
for a deployer to retroactively add after an upgrade.  Just copy/paste.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20150821/402dc5f3/attachment-0001.html>