Include RSAKeyValue In Assertions in IDP v3

[Brent Putman]

On 11/8/16 4:34 PM, Brent Putman wrote:
>
> Once I get the immediate 3.3.0 release stuff out of the way, I'll
> look to see if I have an example lying around.  If not, I'll cook one
> up.  This might be slightly more complex than some of the other
> security conf overrides since you need to build a new generator
> factory instance(s), which go into the Manager.
>

The Spring XML wiring for this is below, which you would just put into
relying-party.xml.  You'd then apply the custom security config bean to
whatever profile(s) you want like so:

<bean parent="SAML2.SSO"
p:securityConfiguration-ref="CustomSigningConfig" />


I tested this and it works for me.

I was going to put this full example into the wiki on the
SecurityConfiguration page, but I realized that this wiring
necessitates use of impl classes, which we usually don't want people to
refer to directly.  So I think before documenting this "officially", we
need to either declare some parent beans for use by deployers, and/or
provide some Spring FactoryBean helpers.  The 2 impl classes referenced
are very unlikely to change, though; I think they literally haven't
changed since the early days of v2.  So I'd say you are pretty safe
using this example for now.

******************************************

KeyInfo generator wiring example:


    <!-- Example of custom signing config with overrides for KeyInfo
generation. -->
    <bean id="NamedKeyInfoGeneratorManager"
class="org.opensaml.xmlsec.keyinfo.NamedKeyInfoGeneratorManager"
        p:useDefaultManager="true" />
       
    <bean id="DefaultKeyInfoGeneratorManager"
factory-bean="NamedKeyInfoGeneratorManager"
factory-method="getDefaultManager" />
   
    <bean
class="org.springframework.beans.factory.config.MethodInvokingBean"
        p:targetObject-ref="DefaultKeyInfoGeneratorManager"
        p:targetMethod="registerFactory">
        <property name="arguments">
            <list>
                <bean
class="org.opensaml.xmlsec.keyinfo.impl.BasicKeyInfoGeneratorFactory"
                    p:emitPublicKeyValue="true"
p:emitPublicDEREncodedKeyValue="true" p:emitKeyNames="true" />
            </list>
        </property>
    </bean>
   
    <bean
class="org.springframework.beans.factory.config.MethodInvokingBean"
        p:targetObject-ref="DefaultKeyInfoGeneratorManager"
        p:targetMethod="registerFactory">
        <property name="arguments">
            <list>
                <bean
class="org.opensaml.xmlsec.keyinfo.impl.X509KeyInfoGeneratorFactory"
                    p:emitEntityCertificate="true"
p:emitEntityCertificateChain="true" p:emitPublicKeyValue="true" />
            </list>
        </property>
    </bean>

    <bean id="CustomSigningConfig"
parent="shibboleth.DefaultSecurityConfiguration">
        <property name="signatureSigningConfiguration">
            <bean parent="shibboleth.SigningConfiguration.SHA256"
p:keyInfoGeneratorManager-ref="NamedKeyInfoGeneratorManager" />
        </property>
    </bean>


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161109/43ba5a1f/attachment.html>