Scriptable DataSealerKeyStrategy Question

[Snyder, Bill]

Hi Scott,

Thanks much for the example, this has proven quite useful.  A few things I've found...

If I include the p:updateInterval attribute on the bean, I get the following exception during servlet initialization:

Caused by: java.lang.IllegalStateException: Cannot convert value of type 'java.lang.String' to required type 'java.time.Duration' for property 'updateInterval': no matching editors or conversion strategy found

Also, after much testing over the last 36 hours, I'm not convinced that anything beyond a simple example can be used with the current solution.

First, I attempted to write the script using JavaScript.  The underlying JavaScript engine included with java (Nashorn) appears to be severely limited in its ability to import and use third party modules.  In my case, I need to be able to import the AWS JavaScript SDK.   I tried unsuccessfully to do this using the typical Node.js way (by leveraging https://github.com/nodyn/jvm-npm)  or by using the minified, stripped down version of the AWS SDK.  In both cases, it was unable to load the SDK.

After having exhausted that effort, I switched to using Jython.  While this initially seemed more promising, I've finally come to the conclusion that Jython as a scripting engine is quite limited.  Apparently there are 2 ways one can run a script in Jython.  The first is via calling exec() and the second is via calling eval() (as is done by the underlying EvaluableScript.java class).  The issues with these 2 are that the former returns "None" for all executions so there is no way to return data to Java and the latter is only intended to run expressions, not statements.  So, simple things like "2*3", not multi-line functions and programs. For more information about eval (and the limitations of using compiled code in eval), see the following 2 links:

https://docs.python.org/2/library/functions.html#eval
https://docs.python.org/2/library/functions.html#compile

While I'm certainly open to trying more things or other scripting engines, I fear that the flexibility/extensibility that the scripting based solution is intending to provide is actually making things more difficult for anything but the simplest use cases.  These issues, coupled with the fact that we still need to define our own bean inside of the global-system.xml file, lead me to believe that writing a custom java class that implements DataSealerKeyStrategy is much simpler and more straight forward.  If anyone has any thoughts of suggestion, I'm all ears.

Thanks,
Bill

On 10/16/19, 8:14 AM, "dev on behalf of Cantor, Scott" <dev-bounces at shibboleth.net on behalf of cantor.2 at osu.edu> wrote:

    Untested example but should be close enough. There are some gaps in the c'tors to create the EvaluableScript objects that I'll patch now (e.g. using a File to build one requires specifying the script language also), but it's nothing fatal for the time being. I forgot that class was a bit low level, we haven't used it directly much.
     
    <bean id="MyDataSealerKeyStrategy"
    	class="net.shibboleth.utilities.java.support.security.impl.ScriptedKeyStrategy"
    	p:updateInterval="%{idp.sealer.updateInterval:PT15M}">
    	<property name="keyScript">
    		<bean class="net.shibboleth.utilities.java.support.scripting.EvaluableScript">
    			<constructor-arg name="engineName">javascript</constructor-arg>
    			<constructor-arg name="scriptSource">
    				<bean class="java.io.File" c:pathname="%{idp.home}/conf/keyStrategyScript.js" />
    			</constructor-arg>
    		</bean>
    	</property>
    </bean>
    
    The idp.sealer.keyStrategy property should be used to enable it with the global-system.xml change that's necessary for this to be pluggable.
    
    I think I described the script contract I defined before, but if I didn't please tell me and I'll put something together.
    
    The best place to write something up on this is in the KB wiki space as a how-to.
    
    -- Scott
    
    
    -- 
    To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net