Move the signing throttling into IdPProtocolSupport so that it effects all signing...

git-svn-id: https://subversion.switch.ch/svn/shibboleth/java-idp/trunk@1321 ab3bd59b-922f-494d-bb5f-6f0a3c29deca

diff --git a/src/edu/internet2/middleware/shibboleth/idp/IdPProtocolSupport.java b/src/edu/internet2/middleware/shibboleth/idp/IdPProtocolSupport.java
index b85483e..768052d 100644 (file)
--- a/src/edu/internet2/middleware/shibboleth/idp/IdPProtocolSupport.java
+++ b/src/edu/internet2/middleware/shibboleth/idp/IdPProtocolSupport.java
@@ -78,6 +78,7 @@ public class IdPProtocolSupport implements Metadata {
        private ArpEngine arpEngine;
        private AttributeResolver resolver;
        private ArtifactMapper artifactMapper;
+       private Semaphore throttle;
 
        IdPProtocolSupport(IdPConfig config, Logger transactionLog, NameMapper nameMapper, ServiceProviderMapper spMapper,
                        ArpEngine arpEngine, AttributeResolver resolver) throws ShibbolethConfigurationException {
@@ -91,6 +92,9 @@ public class IdPProtocolSupport implements Metadata {
                this.resolver = resolver;
                // TODO make this pluggable... and clean up memory impl
                artifactMapper = new MemoryArtifactMapper();
+
+               // Load a semaphore that throttles how many requests the IdP will handle at once
+               throttle = new Semaphore(config.getMaxThreads());
        }
 
        public static void validateEngineData(HttpServletRequest req) throws InvalidClientDataException {
@@ -121,8 +125,8 @@ public class IdPProtocolSupport implements Metadata {
                return spMapper;
        }
 
-       public static void signAssertions(SAMLAssertion[] assertions, RelyingParty relyingParty)
-                       throws InvalidCryptoException, SAMLException {
+       public void signAssertions(SAMLAssertion[] assertions, RelyingParty relyingParty) throws InvalidCryptoException,
+                       SAMLException {
 
                if (relyingParty.getIdentityProvider().getSigningCredential() == null
                                || relyingParty.getIdentityProvider().getSigningCredential().getPrivateKey() == null) {
@@ -140,13 +144,18 @@ public class IdPProtocolSupport implements Metadata {
                                                "The Shibboleth IdP currently only supports signing with RSA and DSA keys.");
                        }
 
-                       assertions[i].sign(assertionAlgorithm, relyingParty.getIdentityProvider().getSigningCredential()
-                                       .getPrivateKey(), Arrays.asList(relyingParty.getIdentityProvider().getSigningCredential()
-                                       .getX509CertificateChain()));
+                       try {
+                               throttle.enter();
+                               assertions[i].sign(assertionAlgorithm, relyingParty.getIdentityProvider().getSigningCredential()
+                                               .getPrivateKey(), Arrays.asList(relyingParty.getIdentityProvider().getSigningCredential()
+                                               .getX509CertificateChain()));
+                       } finally {
+                               throttle.exit();
+                       }
                }
        }
 
-       public static void signResponse(SAMLResponse response, RelyingParty relyingParty) throws SAMLException {
+       public void signResponse(SAMLResponse response, RelyingParty relyingParty) throws SAMLException {
 
                // Make sure we have an appropriate credential
                if (relyingParty.getIdentityProvider().getSigningCredential() == null
@@ -165,9 +174,13 @@ public class IdPProtocolSupport implements Metadata {
                        throw new InvalidCryptoException(SAMLException.RESPONDER,
                                        "The Shibboleth IdP currently only supports signing with RSA and DSA keys.");
                }
-
-               response.sign(responseAlgorithm, relyingParty.getIdentityProvider().getSigningCredential().getPrivateKey(),
-                               Arrays.asList(relyingParty.getIdentityProvider().getSigningCredential().getX509CertificateChain()));
+               try {
+                       throttle.enter();
+                       response.sign(responseAlgorithm, relyingParty.getIdentityProvider().getSigningCredential().getPrivateKey(),
+                                       Arrays.asList(relyingParty.getIdentityProvider().getSigningCredential().getX509CertificateChain()));
+               } finally {
+                       throttle.exit();
+               }
        }
 
        protected void addFederationProvider(Element element) {
@@ -268,4 +281,32 @@ public class IdPProtocolSupport implements Metadata {
 
                return artifactMapper;
        }
+
+       private class Semaphore {
+
+               private int value;
+
+               public Semaphore(int value) {
+
+                       this.value = value;
+               }
+
+               public synchronized void enter() {
+
+                       --value;
+                       if (value < 0) {
+                               try {
+                                       wait();
+                               } catch (InterruptedException e) {
+                                       // squelch and continue
+                               }
+                       }
+               }
+
+               public synchronized void exit() {
+
+                       ++value;
+                       notify();
+               }
+       }
 }
\ No newline at end of file

diff --git a/src/edu/internet2/middleware/shibboleth/idp/IdPResponder.java b/src/edu/internet2/middleware/shibboleth/idp/IdPResponder.java
index a0e8309..424afb8 100644 (file)
--- a/src/edu/internet2/middleware/shibboleth/idp/IdPResponder.java
+++ b/src/edu/internet2/middleware/shibboleth/idp/IdPResponder.java
@@ -77,7 +77,7 @@ public class IdPResponder extends HttpServlet {
        private static Logger log = Logger.getLogger(IdPResponder.class.getName());
        private static Random idgen = new Random();
        private SAMLBinding binding;
-       private Semaphore throttle;
+
        private IdPConfig configuration;
        private HashMap protocolHandlers = new HashMap();
        private IdPProtocolSupport protocolSupport;
@@ -99,9 +99,6 @@ public class IdPResponder extends HttpServlet {
                        // Load global configuration properties
                        configuration = new IdPConfig(originConfig.getDocumentElement());
 
-                       // Load a semaphore that throttles how many requests the IdP will handle at once
-                       throttle = new Semaphore(configuration.getMaxThreads());
-
                        // Load name mappings
                        NameMapper nameMapper = new NameMapper();
                        NodeList itemElements = originConfig.getDocumentElement().getElementsByTagNameNS(
@@ -228,9 +225,6 @@ public class IdPResponder extends HttpServlet {
                log.debug("Recieved a request via GET for location (" + request.getRequestURL() + ").");
 
                try {
-                       // TODO this throttle should probably just wrap signing operations...
-                       throttle.enter();
-
                        // Determine which protocol we are responding to (at this point normally Shibv1 vs. EAuth)
                        IdPProtocolHandler activeHandler = (IdPProtocolHandler) protocolHandlers.get(request.getRequestURL()
                                        .toString());
@@ -251,8 +245,6 @@ public class IdPResponder extends HttpServlet {
                        log.error(ex);
                        displayBrowserError(request, response, ex);
                        return;
-               } finally {
-                       throttle.exit();
                }
        }
 
@@ -355,34 +347,6 @@ public class IdPResponder extends HttpServlet {
                rd.forward(req, res);
        }
 
-       private class Semaphore {
-
-               private int value;
-
-               public Semaphore(int value) {
-
-                       this.value = value;
-               }
-
-               public synchronized void enter() {
-
-                       --value;
-                       if (value < 0) {
-                               try {
-                                       wait();
-                               } catch (InterruptedException e) {
-                                       // squelch and continue
-                               }
-                       }
-               }
-
-               public synchronized void exit() {
-
-                       ++value;
-                       notify();
-               }
-       }
-
 }
 
 class FederationProviderFactory {

diff --git a/src/edu/internet2/middleware/shibboleth/idp/provider/SAMLv1_AttributeQueryHandler.java b/src/edu/internet2/middleware/shibboleth/idp/provider/SAMLv1_AttributeQueryHandler.java
index 6ccaf4c..b366f25 100644 (file)
--- a/src/edu/internet2/middleware/shibboleth/idp/provider/SAMLv1_AttributeQueryHandler.java
+++ b/src/edu/internet2/middleware/shibboleth/idp/provider/SAMLv1_AttributeQueryHandler.java
@@ -275,7 +275,7 @@ public class SAMLv1_AttributeQueryHandler extends BaseServiceHandler implements
                                        }
                                }
                                if (relyingParty.wantsAssertionsSigned() || metaDataIndicatesSignAssertions) {
-                                       IdPProtocolSupport.signAssertions(new SAMLAssertion[]{sAssertion}, relyingParty);
+                                       support.signAssertions(new SAMLAssertion[]{sAssertion}, relyingParty);
                                }
 
                                samlResponse = new SAMLResponse(samlRequest.getId(), null, Collections.singleton(sAssertion), null);

diff --git a/src/edu/internet2/middleware/shibboleth/idp/provider/ShibbolethV1SSOHandler.java b/src/edu/internet2/middleware/shibboleth/idp/provider/ShibbolethV1SSOHandler.java
index bb2b01a..b3516ba 100644 (file)
--- a/src/edu/internet2/middleware/shibboleth/idp/provider/ShibbolethV1SSOHandler.java
+++ b/src/edu/internet2/middleware/shibboleth/idp/provider/ShibbolethV1SSOHandler.java
@@ -237,7 +237,7 @@ public class ShibbolethV1SSOHandler extends BaseHandler implements IdPProtocolHa
                        }
                }
                if (relyingParty.wantsAssertionsSigned() || metaDataIndicatesSignAssertions) {
-                       IdPProtocolSupport.signAssertions((SAMLAssertion[]) assertions.toArray(new SAMLAssertion[0]), relyingParty);
+                       support.signAssertions((SAMLAssertion[]) assertions.toArray(new SAMLAssertion[0]), relyingParty);
                }
 
                // Create artifacts for each assertion
@@ -293,7 +293,7 @@ public class ShibbolethV1SSOHandler extends BaseHandler implements IdPProtocolHa
                        }
                }
                if (relyingParty.wantsAssertionsSigned() || metaDataIndicatesSignAssertions) {
-                       IdPProtocolSupport.signAssertions((SAMLAssertion[]) assertions.toArray(new SAMLAssertion[0]), relyingParty);
+                       support.signAssertions((SAMLAssertion[]) assertions.toArray(new SAMLAssertion[0]), relyingParty);
                }
 
                // Set attributes needed by form
@@ -302,7 +302,7 @@ public class ShibbolethV1SSOHandler extends BaseHandler implements IdPProtocolHa
 
                SAMLResponse samlResponse = new SAMLResponse(null, acceptanceURL, assertions, null);
 
-               IdPProtocolSupport.signResponse(samlResponse, relyingParty);
+               support.signResponse(samlResponse, relyingParty);
 
                createPOSTForm(request, response, samlResponse.toBase64());