Add a parent bean for SHA-1-intolerant XML signature validation.

InCommon · Nov 27, 2013 · bb01cb8 · bb01cb8
1 parent 2a79098
commit bb01cb8
Showing 1 changed file with 23 additions and 0 deletions.
diff --git a/mdx/common-beans.xml b/mdx/common-beans.xml
@@ -100,6 +100,29 @@
         </property>
         <property name="permittingEmptyReferences" value="false"/>
     </bean>
+
+    <!--
+        XMLSignatureValidationStageSHA256
+        
+        Parent for XML signature validation stages where we know
+        the signature will not be made with MD5 or SHA-1.
+    -->
+    <bean id="XMLSignatureValidationStageSHA256" abstract="true"
+        parent="XMLSignatureValidationStage">
+        <property name="blacklistedDigests">
+            <list>
+                <value>http://www.w3.org/2000/09/xmldsig#sha1</value>
+                <value>http://www.w3.org/2001/04/xmldsig-more#md5</value>
+            </list>
+        </property>
+        <property name="blacklistedSignatureMethods">
+            <list>
+                <value>http://www.w3.org/2000/09/xmldsig#rsa-sha1</value>
+                <value>http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1</value>
+                <value>http://www.w3.org/2001/04/xmldsig-more#rsa-md5</value>
+            </list>
+        </property>
+    </bean>
 
     <!--
         XSLTransformationStage