CredentialResolverBasics

This is a very brief introduction to the Hub’s Credential Resolver service. This is a new ReloadableService added by the Hub alongside the ones already supplied with the IdP (metadata, attribute services, etc.) that implements a layer between the rest of the software and access to keys, certificates, secrets, and any other notion that would fall under the heading of a “Credential” used by the Hub when interacting with other systems.

You may periodically or manually reload the service when altering the configuration using the service ID shibboleth.sp.CredentialResolver (or configure relevant properties so it detects changes automatically of course, as with other services).

The initial state of this service after installation of the core plugin only is empty, as by default the core plugin doesn’t use this service for anything. The service is a mechanism for supporting additional components needed by the protocol plugins installed later that do need credentials.

When protocol plugins are installed, the initial configuration of their credentials is designed to be internal to the Hub and controlled with a handful of properties, generally defined in protocol-specific properties files added by those plugins. For example, the SAMLBasicstopic discusses the install-time generation of default keys and how they are specified.

The only “visible” evidence of this service at all are a handful of properties in conf/sp/sp.properties controlling the service and an empty Spring bean file (conf/sp/credentials.xml) which is reserved for later use in the event that simple/global credentials are insufficient for your needs. The actual use of this file is to define additional or replacement components called CredentialResolvers that are able to lookup and supply keys, certificates, and secrets based on configurable criteria that are associated with a Hub operation.

Actually configuring these components is a more advanced topic and is in some cases protocol plugin-specific. Refer to CredentialResolverService.