x509certificate - Spring Security SAML trusted certificate entries are not password-protected -


i'm integrating spring-saml2-sample app own application. service provider connects shibboleth idp. i'm testing sp private certificate provided in samlkeystore.jks came spring security saml application. registered idp signing public key in keystore using command: keytool -importcert -alias idpsignkey -keypass passwords -file key.cer -keystore samlkeystore.jks

i'm able run app , login idp. can see in log public certificate send me in saml message corresponds 1 have in idp metadata , registered in keystore. app breaks while getting idp credential jkskeymanager.

java.lang.unsupportedoperationexception: trusted certificate entries not password-protected java.security.keystorespi.enginegetentry(unknown source) java.security.keystore.getentry(unknown source) org.opensaml.xml.security.credential.keystorecredentialresolver.resolvefromsource(keystorecredentialresolver.java:132) org.opensaml.xml.security.credential.abstractcriteriafilteringcredentialresolver.resolve(abstractcriteriafilteringcredentialresolver.java:57) org.opensaml.xml.security.credential.abstractcredentialresolver.resolvesingle(abstractcredentialresolver.java:30) org.opensaml.xml.security.credential.abstractcredentialresolver.resolvesingle(abstractcredentialresolver.java:26) org.springframework.security.saml.key.jkskeymanager.resolvesingle(jkskeymanager.java:172) org.springframework.security.saml.key.jkskeymanager.getcredential(jkskeymanager.java:194) org.springframework.security.saml.trust.metadatacredentialresolver.retrievefrommetadata(metadatacredentialresolver.java:102) org.opensaml.security.metadatacredentialresolver.resolvefromsource(metadatacredentialresolver.java:169)

this how keymanager looks in contextsecurity.xml:

<!-- central storage of cryptographic keys --> <bean id="keymanager" class="org.springframework.security.saml.key.jkskeymanager"> <constructor-arg value="classpath:security/samlkeystore.jks"/> <constructor-arg type="java.lang.string" value="nalle123"/> <constructor-arg> <map> <entry key="apollo" value="nalle123"/> <entry key="idpsignkey" value="passwords"/> <entry key="idpenckey" value="passworde"/> </map> </constructor-arg> <constructor-arg type="java.lang.string" value="apollo"/> </bean>

this extended metadata idp:

<bean class="org.springframework.security.saml.metadata.extendedmetadata"> <property name="local" value="false"/> <property name="securityprofile" value="metaiop"/> <property name="sslsecurityprofile" value="pkix"/> <property name="signingkey" value="idpsignkey"/> <property name="encryptionkey" value="idpenckey"/> <property name="requireartifactresolvesigned" value="false"/> <property name="requirelogoutrequestsigned" value="false"/> <property name="requirelogoutresponsesigned" value="false"/> <property name="idpdiscoveryenabled" value="false"/> </bean>

certificates idps not need typically imported keystore provided idp's metadata. should use extendedmetadata , properties signingkey and/or encryptionkey in case want supplement keys available in metadata.

as file key.cer contains public key of idp, cannot password protect it. should remove map used initialization of jkskeymanager needs passwords entries include private keys. initialization this:

<!-- central storage of cryptographic keys --> <bean id="keymanager" class="org.springframework.security.saml.key.jkskeymanager">     <constructor-arg value="classpath:security/samlkeystore.jks"/>     <constructor-arg type="java.lang.string" value="nalle123"/>     <constructor-arg>         <map>             <entry key="apollo" value="nalle123"/>         </map>     </constructor-arg>     <constructor-arg type="java.lang.string" value="apollo"/> </bean>

Comments

Post a Comment

Popular posts from this blog

php - Submit Form Data without Reloading page -

i know question has been asked , answered bunch of times life of me can not solution work on code. believe if redo code, work properly, , in retrospect time i've spent on issue should have redone code...but beyond deadline , have working prototype up... can advise how update multiple forms on single page without reloading page? horrible @ php , complete noob js/jquery/ajax @ best. html/php in single file , believe causing me problems/is largest obstacle @ getting ajax form processing work. basically, want users to: select teams multiple dropdowns in form group 1 (league champs) , on update update db newly selected team without reloadding page. edit team scores per match , on score submit/update, update db new scores. for each requirement there multiple forms (1 each leagues, 1 each per match) have set class on each form id. everything works via php, form submission reloads page each time submitted , not ideal. i have tried ajax code here http://scotch.io/tutoria...
Read more

linux - Rails running on virtual machine in Windows -

the reason why want switch ubuntu people said gems works better on linux on windows. i don't want macbook pro rails development since love windows , cannot stand lack of apps mac. moreover, people saying ubuntu "better" mac: http://www.reddit.com/r/ubuntu/comments/1bgj1s/are_there_advantages_of_ubuntu_over_os_x_for/ does virtual box work enough doesn't have lag @ all? using i7-3517u cpu 8gb memory. need program in environment lag-free , not sluggish. or there alternatives recommend? i unsure permission settings or complicated stuffs regarding terminal. i'll using terminal develop. i'm still quite new here development in linux. please kind me >< thanks. @holyxiaoxin pretty sure should asking on superuser instead. nevertheless, suggest install ubuntu in partition instead of running virtual machine. here's guide https://help.ubuntu.com/community/windowsdualboot also, yes. developing in virtual machine accurate, @ end experiment w...
Read more