<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 11/8/16 4:34 PM, Brent Putman wrote:<br>
</div>
<blockquote
cite="mid:8bcdbfc2-ca8c-5614-65a7-d60c69a1fa26@georgetown.edu"
type="cite">
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 11/8/16 10:05 AM, Cantor, Scott
wrote:<br>
</div>
<blockquote
cite="mid:5a92e2d1-bc5e-9030-4bc7-82d47f5f5817@osu.edu"
type="cite"><br>
<pre wrap="">I know you need a custom SecurityConfiguration on a relying party, and
you'd probably need to override the SigningConfiguration slot with an
object with a non-default keyInfoGeneratorManager property.
</pre>
</blockquote>
<br>
Yes, that's pretty much the gist of it. <br>
<br>
</blockquote>
<br>
Actually, just looking at it quickly, there's another route to
this. It does not emit the KeyValue by default if what you have is
an X509Credential. However, we already will emit the KeyValue (and
DEREncodedKeyValue) by default if the signing cred is a basic public
key Credential, not an X509 one. I think we already support wiring
a non-X509 cred in the IdP [1], so I think you could just wire up
such a credential and follow the instructions here [2] on setting up
a per-profile credential to use that instead of your default X509
one.<br>
<br>
Note that this approach won't emit any cert stuff obviously, so if
you needed the X509Data AND the KeyValue, then this won't work and
you need to do the full thing similar to below.<br>
<br>
You can reuse the private key from your existing X509 cred
obviously, and get the naked public key by extracting it from your
cert (unless we already save the naked signing public key on an IdP
install, I don't know off-hand).<br>
<br>
<br>
<br>
<blockquote
cite="mid:8bcdbfc2-ca8c-5614-65a7-d60c69a1fa26@georgetown.edu"
type="cite"><br>
Once I get the immediate 3.3.0 release stuff out of the way, I'll
look to see if I have an example lying around. If not, I'll cook
one up. This might be slightly more complex than some of the
other security conf overrides since you need to build a new
generator factory instance(s), which go into the Manager. <br>
<br>
</blockquote>
<br>
If anyone really wants to give this a try in the interim, what you
need to do is 1) replicate something like the code below from
DefaultSecurityConfigurationBootstrap to build the
KeyInfoGeneratorManager in Spring wiring 2) change the X509 factory
to emit the KeyValue (e.g. equiv of
x509Factory.setEmitPublicKeyValue(true)) and 3) set this manger on a
signature signing config instance on the property
keyInfoGeneratorManager. There's a couple of non-Java bean-y things
in there, so probably need some use of Spring bean syntax's
factoryMethod and factoryBean, etc.<br>
<br>
If this is a common need, we could look to simplify some of this
with a custom factory bean.<br>
<br>
<br>
<tt> protected static NamedKeyInfoGeneratorManager
buildSignatureKeyInfoGeneratorManager() {</tt><tt><br>
</tt><tt> NamedKeyInfoGeneratorManager namedManager = new
NamedKeyInfoGeneratorManager();</tt><tt><br>
</tt><tt> </tt><tt><br>
</tt><tt> namedManager.setUseDefaultManager(true);</tt><tt><br>
</tt><tt> KeyInfoGeneratorManager defaultManager =
namedManager.getDefaultManager();</tt><tt><br>
</tt><tt> </tt><tt><br>
</tt><tt> // Generator for basic Credentials</tt><tt><br>
</tt><tt> BasicKeyInfoGeneratorFactory basicFactory = new
BasicKeyInfoGeneratorFactory();</tt><tt><br>
</tt><tt> basicFactory.setEmitPublicKeyValue(true);</tt><tt><br>
</tt><tt> basicFactory.setEmitPublicDEREncodedKeyValue(true);</tt><tt><br>
</tt><tt> basicFactory.setEmitKeyNames(true);</tt><tt><br>
</tt><tt> </tt><tt><br>
</tt><tt> // Generator for X509Credentials</tt><tt><br>
</tt><tt> X509KeyInfoGeneratorFactory x509Factory = new
X509KeyInfoGeneratorFactory();</tt><tt><br>
</tt><tt> x509Factory.setEmitEntityCertificate(true);</tt><tt><br>
</tt><tt> x509Factory.setEmitEntityCertificateChain(true);</tt><tt><br>
</tt><tt> </tt><tt><br>
</tt><tt> defaultManager.registerFactory(basicFactory);</tt><tt><br>
</tt><tt> defaultManager.registerFactory(x509Factory);</tt><tt><br>
</tt><tt> </tt><tt><br>
</tt><tt> return namedManager;</tt><tt><br>
</tt><tt> }</tt><tt><br>
</tt><br>
<br>
<br>
[1]
<a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/IDP30/CredentialBeanFactories">https://wiki.shibboleth.net/confluence/display/IDP30/CredentialBeanFactories</a><br>
<br>
[2]
<a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/IDP30/SecurityConfiguration#SecurityConfiguration-SigningandEncryptionConfiguration">https://wiki.shibboleth.net/confluence/display/IDP30/SecurityConfiguration#SecurityConfiguration-SigningandEncryptionConfiguration</a><br>
</body>
</html>