Will the default DataSealer stay replaceable?

[Bachl, Mathias]

Hi!

We would prefer to use a replicated in-memory storage system instead of the DataSealer/AES-encryption mechanism for ensuring clustering-capability of the OIDC OP functionality (nodes need to read the OIDC authorization codes of other nodes), for security/performance reasons (file-based key storage doesn't fit our security requirements, HSM-based crypto was used so far but we have load issues...

The OIDC OP plugin seems to allow to replace the default DataSealer bean shibboleth.oidc.TokenSealer with a custom one (with the idp.oidc.tokenSealer property), so the idea is to extend net.shibboleth.shared.security.DataSealer and overwrite the wrap/unwrap methods with a custom implementation that writes/reads the data to a replicated in-memory storage instead of encrypting/decrypting it.
We assume this should work (does it?), BUT: We discovered the comment "TODO: make final" in net.shibboleth.shared.security.DataSealer - are there plans to introduce an interface or something like that to be able to replace the default DataSealer in the future, or is the plan to stop allowing customization of this functionality?

Is there a better/more correct solution for our issue?

Thanks in advance & best regards,

Mathias Bachl
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20250430/c4de98c2/attachment.htm>