From 422cf4c647608bb224db2b7b9fb97797ed94f28c Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Thu, 14 Nov 2013 08:15:46 +0000
Subject: [PATCH] Add key length check to eduGAIN verify verb. Note: not
 included in production checks.

---
 mdx/int_edugain/verbs.xml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/mdx/int_edugain/verbs.xml b/mdx/int_edugain/verbs.xml
index 7194e8e7..0f6d7909 100644
--- a/mdx/int_edugain/verbs.xml
+++ b/mdx/int_edugain/verbs.xml
@@ -76,6 +76,18 @@
                     p:id="us_incommon_pilot_filterEntities"
                     p:whitelistingEntities="false"
                     p:designatedEntities-ref="int_edugain_verify_blacklist"/>
+
+                <bean parent="X509CertificateValidationStage"
+                    p:id="checkCertificates">
+                    <property name="validators">
+                        <list>
+                            <!-- Error on RSA key length less than 2048 bits. -->
+                            <bean parent="X509CertificateRSAKeyLengthValidator"
+                                p:warningBoundary="0" p:errorBoundary="2048"/>
+                        </list>
+                    </property>
+                </bean>
+
                 <ref bean="standardImportActions"/>
                 <ref bean="errorTerminatingFilter"/>
             </list>