<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 11/8/16 4:34 PM, Brent Putman wrote:</div>
<blockquote
cite="mid:8bcdbfc2-ca8c-5614-65a7-d60c69a1fa26@georgetown.edu"
type="cite">
<blockquote
cite="mid:5a92e2d1-bc5e-9030-4bc7-82d47f5f5817@osu.edu"
type="cite"> </blockquote>
<br>
Once I get the immediate 3.3.0 release stuff out of the way, I'll
look to see if I have an example lying around. If not, I'll cook
one up. This might be slightly more complex than some of the
other security conf overrides since you need to build a new
generator factory instance(s), which go into the Manager. <br>
<br>
</blockquote>
<br>
The Spring XML wiring for this is below, which you would just put
into relying-party.xml. You'd then apply the custom security config
bean to whatever profile(s) you want like so:<br>
<br>
<tt><bean parent="SAML2.SSO"
p:securityConfiguration-ref="CustomSigningConfig" /><br>
<br>
</tt><tt></tt><br>
I tested this and it works for me.<br>
<br>
I was going to put this full example into the wiki on the
SecurityConfiguration page, but I realized that this wiring
necessitates use of impl classes, which we usually don't want people
to refer to directly. So I think before documenting this
"officially", we need to either declare some parent beans for use by
deployers, and/or provide some Spring FactoryBean helpers. The 2
impl classes referenced are very unlikely to change, though; I think
they literally haven't changed since the early days of v2. So I'd
say you are pretty safe using this example for now.<br>
<br>
******************************************<br>
<br>
KeyInfo generator wiring example:<br>
<br>
<br>
<tt> <!-- Example of custom signing config with overrides for
KeyInfo generation. --></tt><tt><br>
</tt><tt> <bean id="NamedKeyInfoGeneratorManager"
class="org.opensaml.xmlsec.keyinfo.NamedKeyInfoGeneratorManager" </tt><tt><br>
</tt><tt> p:useDefaultManager="true" /></tt><tt><br>
</tt><tt> </tt><tt><br>
</tt><tt> <bean id="DefaultKeyInfoGeneratorManager"
factory-bean="NamedKeyInfoGeneratorManager"
factory-method="getDefaultManager" /></tt><tt><br>
</tt><tt> </tt><tt><br>
</tt><tt> <bean
class="org.springframework.beans.factory.config.MethodInvokingBean"</tt><tt><br>
</tt><tt> p:targetObject-ref="DefaultKeyInfoGeneratorManager"</tt><tt><br>
</tt><tt> p:targetMethod="registerFactory"></tt><tt><br>
</tt><tt> <property name="arguments"></tt><tt><br>
</tt><tt> <list></tt><tt><br>
</tt><tt> <bean
class="org.opensaml.xmlsec.keyinfo.impl.BasicKeyInfoGeneratorFactory"</tt><tt><br>
</tt><tt> p:emitPublicKeyValue="true"
p:emitPublicDEREncodedKeyValue="true" p:emitKeyNames="true" /></tt><tt><br>
</tt><tt> </list></tt><tt><br>
</tt><tt> </property></tt><tt><br>
</tt><tt> </bean></tt><tt><br>
</tt><tt> </tt><tt><br>
</tt><tt> <bean
class="org.springframework.beans.factory.config.MethodInvokingBean"</tt><tt><br>
</tt><tt> p:targetObject-ref="DefaultKeyInfoGeneratorManager"</tt><tt><br>
</tt><tt> p:targetMethod="registerFactory"></tt><tt><br>
</tt><tt> <property name="arguments"></tt><tt><br>
</tt><tt> <list></tt><tt><br>
</tt><tt> <bean
class="org.opensaml.xmlsec.keyinfo.impl.X509KeyInfoGeneratorFactory"</tt><tt><br>
</tt><tt> p:emitEntityCertificate="true"
p:emitEntityCertificateChain="true" p:emitPublicKeyValue="true"
/></tt><tt><br>
</tt><tt> </list></tt><tt><br>
</tt><tt> </property></tt><tt><br>
</tt><tt> </bean></tt><tt><br>
</tt><tt><br>
</tt><tt> <bean id="CustomSigningConfig"
parent="shibboleth.DefaultSecurityConfiguration"></tt><tt><br>
</tt><tt> <property
name="signatureSigningConfiguration"></tt><tt><br>
</tt><tt> <bean
parent="shibboleth.SigningConfiguration.SHA256"
p:keyInfoGeneratorManager-ref="NamedKeyInfoGeneratorManager" /></tt><tt><br>
</tt><tt> </property></tt><tt><br>
</tt><tt> </bean></tt><tt><br>
</tt><tt><br>
</tt><br>
</body>
</html>