TrustEngine for X.509 client certificate authentication

[Etienne Dysli-Metref]

Hi list,

I'm trying to define a TrustEngine using the Spring bean syntax to
validate client certificates during the X.509 login flow, but I'm
stumbling upon an error instantiating a PKIXResourceValidationInfo with
the factory PKIXResourceValidationInfoFactoryBean. Is that the right way
to create such an instance?

Here are my bean definitions (in conf/global.xml):

<bean id="TrustEngine"
  class="org.opensaml.security.x509.impl.PKIXX509CredentialTrustEngine">
  <constructor-arg name="resolver"
                   ref="StaticPKIXValidationInformationResolver"/>
  <constructor-arg name="pkixEvaluator">
    <bean
class="org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator">
      <constructor-arg name="newOptions"
                       ref="CertPathPKIXValidationOptions"/>
    </bean>
  </constructor-arg>
  <constructor-arg name="nameEvaluator">
    <bean
class="org.opensaml.security.x509.impl.BasicX509CredentialNameEvaluator"/>
  </constructor-arg>
</bean>

<bean id="StaticPKIXValidationInformationResolver"
class="org.opensaml.security.x509.impl.StaticPKIXValidationInformationResolver">
  <constructor-arg name="info">
    <list>
      <ref bean="PKIXResourceValidationInfo"/>
    </list>
  </constructor-arg>
  <constructor-arg name="names">
    <set/>
  </constructor-arg>
</bean>

<bean id="PKIXResourceValidationInfo"
      factory-method="getObject"
      factory-bean="PKIXResourceValidationInfoFactoryBean"/>

<bean id="PKIXResourceValidationInfoFactoryBean"
class="net.shibboleth.idp.profile.spring.relyingparty.security.trustengine.impl.PKIXResourceValidationInfoFactoryBean">
  <property name="certificates">
    <list>
      <bean class="org.springframework.core.io.FileSystemResource"
            c:path="/etc/pki/tls/certs/client-auth.crt"/>
    </list>
  </property>
  <property name="verifyDepth" value="2"/>
</bean>

<bean id="CertPathPKIXValidationOptions"
  class="org.opensaml.security.x509.impl.CertPathPKIXValidationOptions"
  p:anyPolicyInhibit="true"
  p:forceRevocationEnabled="true"
  p:policyMappingInhibit="true"/>


Whatever value I use for factory-method on PKIXResourceValidationInfo
(Javadoc at [1]), Spring says:

> org.springframework.beans.factory.BeanCreationException: Error 
> creating bean with name 'PKIXResourceValidationInfo' defined in file 
> [/opt/shibboleth-idp/system/conf/../../conf/global.xml]: No matching 
> factory method found: factory bean 
> 'PKIXResourceValidationInfoFactoryBean'; factory method
> 'getObject()'. Check that a method with the specified name exists and
> that it is non-static.

I can't yet see what I'm doing wrong... maybe another pair of eyes will
help. ;)

  Etienne

[1]
https://build.shibboleth.net/jenkins/job/java-identity-provider-nightly/javadoc/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/PKIXResourceValidationInfoFactoryBean.html

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: OpenPGP digital signature
URL: <http://shibboleth.net/pipermail/users/attachments/20160705/29265b3d/attachment.sig>