From 550d735b136a579851ca091063936f803a2fea0d Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Thu, 14 Nov 2013 08:19:07 +0000
Subject: [PATCH] Add key length check to eduGAIN verify verbs on individual
 channels. Note: not included in production checks.

---
 mdx/at_aconet/verbs.xml | 12 ++++++++++++
 mdx/cl_cofre/verbs.xml  | 12 ++++++++++++
 mdx/se_swamid/verbs.xml | 12 ++++++++++++
 3 files changed, 36 insertions(+)

diff --git a/mdx/at_aconet/verbs.xml b/mdx/at_aconet/verbs.xml
index 877be2a3..7a545f9a 100644
--- a/mdx/at_aconet/verbs.xml
+++ b/mdx/at_aconet/verbs.xml
@@ -81,6 +81,18 @@
             <list>
                 <ref bean="at_aconet_edugainEntities"/>
                 <ref bean="standardImportActions"/>
+
+                <bean parent="X509CertificateValidationStage"
+                    p:id="checkCertificates">
+                    <property name="validators">
+                        <list>
+                            <!-- Error on RSA key length less than 2048 bits. -->
+                            <bean parent="X509CertificateRSAKeyLengthValidator"
+                                p:warningBoundary="0" p:errorBoundary="2048"/>
+                        </list>
+                    </property>
+                </bean>
+
                 <ref bean="errorTerminatingFilter"/>
             </list>
         </property>
diff --git a/mdx/cl_cofre/verbs.xml b/mdx/cl_cofre/verbs.xml
index 8b66600f..f7bab995 100644
--- a/mdx/cl_cofre/verbs.xml
+++ b/mdx/cl_cofre/verbs.xml
@@ -59,6 +59,18 @@
             <list>
                 <ref bean="cl_cofre_edugainEntities"/>
                 <ref bean="standardImportActions"/>
+
+                <bean parent="X509CertificateValidationStage"
+                    p:id="checkCertificates">
+                    <property name="validators">
+                        <list>
+                            <!-- Error on RSA key length less than 2048 bits. -->
+                            <bean parent="X509CertificateRSAKeyLengthValidator"
+                                p:warningBoundary="0" p:errorBoundary="2048"/>
+                        </list>
+                    </property>
+                </bean>
+
                 <ref bean="errorTerminatingFilter"/>
             </list>
         </property>
diff --git a/mdx/se_swamid/verbs.xml b/mdx/se_swamid/verbs.xml
index e281a6fa..82db599e 100644
--- a/mdx/se_swamid/verbs.xml
+++ b/mdx/se_swamid/verbs.xml
@@ -81,6 +81,18 @@
             <list>
                 <ref bean="se_swamid_edugainEntities"/>
                 <ref bean="standardImportActions"/>
+
+                <bean parent="X509CertificateValidationStage"
+                    p:id="checkCertificates">
+                    <property name="validators">
+                        <list>
+                            <!-- Error on RSA key length less than 2048 bits. -->
+                            <bean parent="X509CertificateRSAKeyLengthValidator"
+                                p:warningBoundary="0" p:errorBoundary="2048"/>
+                        </list>
+                    </property>
+                </bean>
+
                 <ref bean="errorTerminatingFilter"/>
             </list>
         </property>