Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Expand
titleBeans

These beans are typically defined internally in various system files for use, or are defined in conf/credentials.xml or conf/relying-party.xml:

Name

Type

Description

shibboleth.BasicX509CredentialFactoryBean 4.3

BasicX509CredentialFactoryBean

Parent bean used for defining an X.509 keypair via external resources (this is the most common way)

shibboleth.X509InlineCredentialFactoryBean 4.3

X509InlineCredentialFactoryBean

Parent bean used for defining an X.509 credential via inline data

shibboleth.BasicResourceCredentialFactoryBean 4.3

BasicResourceCredentialFactoryBean

Parent bean used for defining a basic public/private or secret credential via external resources

shibboleth.BasicInlineCredentialFactoryBean 4.3

BasicInlineCredentialFactoryBean

Parent bean used for defining a basic public/private or secret credential via inline data

shibboleth.DefaultSigningCredential

Credential 

Keypair used for signing, usually including a certificate

shibboleth.DefaultClientTLSCredential

Credential

Keypair used for client TLS, including a certificate

shibboleth.DefaultEncryptionCredentials

List<Credential>

Collection of keypairs used to decrypt data sent by others (technically only the private key matters here)

shibboleth.DefaultSecurityConfiguration

SecurityConfiguration

Default security configuration used by all profile beans

shibboleth.SecurityConfiguration.SHA256

SecurityConfiguration

Security configuration that directly incorporates the SHA-256 signing configuration

shibboleth.SecurityConfiguration.SHA1

SecurityConfiguration

Security configuration that directly incorporates the SHA-1 signing configuration

shibboleth.SecurityConfiguration.CBC

SecurityConfiguration

Security configuration that directly incorporates the AES-CBC encryption configuration

shibboleth.SecurityConfiguration.GCM

SecurityConfiguration

Security configuration that directly incorporates the AES-GCM encryption configuration

shibboleth.SigningConfiguration.SHA256

BasicSignatureSigningConfiguration

Signing configuration that uses the SHA-256 digest algorithm

shibboleth.SigningConfiguration.SHA1

BasicSignatureSigningConfiguration

Signing configuration that uses the SHA-1 digest algorithm

shibboleth.EncryptionConfiguration.CBC

EncryptionConfiguration

Encryption configuration that uses the AES-CBC encryption algorithm

shibboleth.EncryptionConfiguration.GCM

EncryptionConfiguration

Encryption configuration that uses the AES-GCM encryption algorithm

shibboleth.ExplicitKeySignatureTrustEngine

ExplicitKeySignatureTrustEngine

Signature verifier that relies on explicit keys in metadata

shibboleth.PKIXSignatureTrustEngine

PKIXSignatureTrustEngine

Signature verifier that validates certificates against PKIX rules in metadata

shibboleth.ChainingSignatureTrustEngine

ChainingSignatureTrustEngine

Signature verifier that chains the previous two beans together

shibboleth.ExplicitKeyX509TrustEngine

ExplicitKeyTrustEngine

Client certificate verifier that relies on explicit keys in metadata

shibboleth.PKIXX509TrustEngine

PKIXX509CredentialTrustEngine

Client certificate verifier that validates certificates against PKIX rules in metadata

shibboleth.ChainingX509TrustEngine

ChainingTrustEngine

Client certificate verifier that chains the previous two beans together

shibboleth.SameSiteCookieMap

Map<String,SameSiteValue>

Map of rules for assigning explicit SameSite values to specific cookies via servlet filter

shibboleth.BasicKeyInfoGeneratorFactory 4.1

BasicKeyInfoGeneratorFactory

Parent bean for defining custom KeyInfo behavior for non-certificate credentials

shibboleth.X509KeyInfoGeneratorFactory 4.1

X509KeyInfoGeneratorFactory

Parent bean for defining custom KeyInfo behavior for X.500 certificates

The following beans may be defined in conf/global.xml and are, as a result, not reloadable. These lists override library defaults globally and allow updates to these policies in the event of an algorithm compromise or other local constraints.

Name

Type

Description

shibboleth.SignatureWhitelist (DEPRECATED)

shibboleth.IncludedSignatureAlgorithms 4.1

Set<String>

Explicitly names signature and digest algorithms to allow, with others disallowed

shibboleth.SignatureBlacklist (DEPRECATED)

shibboleth.ExcludedSignatureAlgorithms 4.1

Set<String>

Explicitly names signature and digest algorithms to block, with others allowed

shibboleth.EncryptionWhitelist (DEPRECATED)

shibboleth.IncludedEncryptionAlgorithms 4.1

Set<String>

Explicitly names encryption algorithms to allow, with others disallowed

shibboleth.EncryptionBlacklist (DEPRECATED)

shibboleth.ExcludedEncryptionAlgorithms 4.1

Set<String>

Explicitly names encryption algorithms to block, with others allowed

...