[java-idp-oidc] branch main updated: JOIDC-15 - Reduce manual configuration integration touchpoints with IdP
Scott Cantor
cantor.2 at osu.edu
Thu Nov 5 01:07:25 UTC 2020
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=87e245f1fd218cccfde51ff393ecbe7a873ddf19
The following commit(s) were added to refs/heads/main by this push:
new 87e245f1 JOIDC-15 - Reduce manual configuration integration touchpoints with IdP
87e245f1 is described below
commit 87e245f1fd218cccfde51ff393ecbe7a873ddf19
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Nov 4 20:07:19 2020 -0500
JOIDC-15 - Reduce manual configuration integration touchpoints with IdP
https://issues.shibboleth.net/jira/browse/JOIDC-15
Elimination of global-oidc.xml import.
---
.../resources/conf/attribute-resolver-oidc.xml | 6 +-
.../src/main/resources/conf/global-oidc.xml | 67 ------------------
.../src/main/resources/conf/services-oidc.xml | 19 -----
.../META-INF/net.shibboleth.idp/postconfig.xml | 82 ++++++++++++++++++++++
.../idp/flows/oidc/authorize/authorize-beans.xml | 2 +-
.../idp/flows/oidc/token/token-beans.xml | 2 +-
.../idp/flows/oidc/userinfo/token-beans.xml | 2 +-
.../src/test/resources/conf/attribute-resolver.xml | 2 +-
.../src/test/resources/conf/global-oidc.xml | 45 ------------
.../src/test/resources/conf/services-oidc.xml | 19 -----
10 files changed, 89 insertions(+), 157 deletions(-)
diff --git a/idp-oidc-extension-distribution/src/main/resources/conf/attribute-resolver-oidc.xml b/idp-oidc-extension-distribution/src/main/resources/conf/attribute-resolver-oidc.xml
index eb0aaa0d..2124167d 100644
--- a/idp-oidc-extension-distribution/src/main/resources/conf/attribute-resolver-oidc.xml
+++ b/idp-oidc-extension-distribution/src/main/resources/conf/attribute-resolver-oidc.xml
@@ -16,7 +16,7 @@
There has to be exactly one resolved and filtered attribute that would be encoded as 'sub'.
This example attribute (the data connector actually ) will generate public or pairwise 'sub' depending on client registration data. -->
- <AttributeDefinition id="subject" xsi:type="Simple" activationConditionRef="SubjectRequired">
+ <AttributeDefinition id="subject" xsi:type="Simple" activationConditionRef="shibboleth.oidc.Conditions.SubjectRequired">
<InputDataConnector ref="computedSubjectId" attributeNames="subjectId"/>
<AttributeEncoder xsi:type="oidcext:OIDCString" name="sub" />
</AttributeDefinition>
@@ -27,12 +27,12 @@
Use activation conditions and filters to ensure the requirement is met if you have need for several different kind of formats for 'sub'.
- <AttributeDefinition id="subject-public" xsi:type="Simple" activationConditionRef="PublicRequired">
+ <AttributeDefinition id="subject-public" xsi:type="Simple" activationConditionRef="shibboleth.oidc.Conditions.PublicRequired">
<InputAttributeDefinition ref="uid" />
<AttributeEncoder xsi:type="oidcext:OIDCString" name="sub" />
</AttributeDefinition>
- <AttributeDefinition id="subject-pairwise" xsi:type="Simple" activationConditionRef="PairwiseRequired">
+ <AttributeDefinition id="subject-pairwise" xsi:type="Simple" activationConditionRef="shibboleth.oidc.Conditions.PairwiseRequired">
<InputDataConnector ref="computedSubjectId" attributeNames="subjectId"/>
<AttributeEncoder xsi:type="oidcext:OIDCString" name="sub" />
</AttributeDefinition>
diff --git a/idp-oidc-extension-distribution/src/main/resources/conf/global-oidc.xml b/idp-oidc-extension-distribution/src/main/resources/conf/global-oidc.xml
deleted file mode 100644
index eda9e64e..00000000
--- a/idp-oidc-extension-distribution/src/main/resources/conf/global-oidc.xml
+++ /dev/null
@@ -1,67 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
- xmlns:context="http://www.springframework.org/schema/context"
- xmlns:util="http://www.springframework.org/schema/util" xmlns:p="http://www.springframework.org/schema/p"
- xmlns:c="http://www.springframework.org/schema/c" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-
- default-init-method="initialize" default-destroy-method="destroy">
-
- <!--
- This file contains global oidc bean definitions.
- This file should be imported to global.xml
- -->
-
- <!-- OIDC authentication context class reference parent declaration -->
- <bean id="shibboleth.OIDCAuthnContextClassReference"
- class="org.geant.idpextension.oidc.authn.principal.AuthenticationContextClassReferencePrincipal" abstract="true" />
-
- <!-- Returns true if resolver is executed in authz endpoint. -->
- <bean id="SubjectRequired" class="org.geant.idpextension.oidc.profile.logic.SubjectActivationCondition" />
-
- <!-- Returns true if client has registered public subject and resolver is executed in authz endpoint -->
- <bean id="PublicRequired" parent="shibboleth.Conditions.AND">
- <constructor-arg>
- <list>
- <bean class="org.geant.idpextension.oidc.profile.logic.SubjectActivationCondition" />
- <bean class="org.geant.idpextension.oidc.profile.logic.PublicSubjectActivationCondition" />
- </list>
- </constructor-arg>
- </bean>
-
- <!-- Returns true if client has registered pairwise subject and resolver is executed in authz endpoint -->
- <bean id="PairwiseRequired" parent="shibboleth.Conditions.AND">
- <constructor-arg>
- <list>
- <bean class="org.geant.idpextension.oidc.profile.logic.SubjectActivationCondition" />
- <bean class="org.geant.idpextension.oidc.profile.logic.PairwiseSubjectActivationCondition" />
- </list>
- </constructor-arg>
- </bean>
-
- <!-- List of reserved claims that will not be populated to id token using standard user claim population mechanisms -->
- <util:list id="shibboleth.oidc.IDTokenReservedClaimNames">
- <value>aud</value>
- <value>iss</value>
- <value>sub</value>
- <value>iat</value>
- <value>exp</value>
- <value>acr</value>
- <value>aud</value>
- <value>auth_time</value>
- <value>at_hash</value>
- <value>c_hash</value>
- <value>nonce</value>
- </util:list>
-
- <!-- List of reserved claims that will not be populated to user info response using standard user claim population mechanisms -->
- <util:list id="shibboleth.oidc.UserInfoReservedClaimNames">
- <value>aud</value>
- <value>iss</value>
- <value>sub</value>
- </util:list>
-
-
-</beans>
diff --git a/idp-oidc-extension-distribution/src/main/resources/conf/services-oidc.xml b/idp-oidc-extension-distribution/src/main/resources/conf/services-oidc.xml
index 9b34ae97..734c6ff4 100755
--- a/idp-oidc-extension-distribution/src/main/resources/conf/services-oidc.xml
+++ b/idp-oidc-extension-distribution/src/main/resources/conf/services-oidc.xml
@@ -13,25 +13,6 @@
This file should be imported to services.xml
-->
- <bean id="shibboleth.ClientInformationResolverService"
- class="net.shibboleth.ext.spring.service.ReloadableSpringService"
- depends-on="shibboleth.AttributeResolverService"
- p:serviceConfigurations-ref="shibboleth.ClientInformationResolverResources"
- p:failFast="%{idp.service.metadata.failFast:%{idp.service.failFast:false}}"
- p:reloadCheckDelay="%{idp.service.metadata.checkInterval:PT0S}"
- p:beanFactoryPostProcessors-ref="shibboleth.PropertySourcesPlaceholderConfigurer">
- <constructor-arg name="claz"
- value="org.geant.idpextension.oidc.metadata.resolver.ClientInformationResolver" />
- <constructor-arg name="strategy">
- <bean
- class="org.geant.idpextension.oidc.profile.spring.relyingparty.metadata.impl.ClientInformationResolverServiceStrategy" />
- </constructor-arg>
- </bean>
-
- <bean id="shibboleth.ClientInformationResolver"
- class="org.geant.idpextension.oidc.metadata.impl.ReloadingRelyingPartyClientInformationProvider"
- c:resolverService-ref="shibboleth.ClientInformationResolverService" />
-
<util:list id="shibboleth.ClientInformationResolverResources">
<value>%{idp.home}/conf/oidc-metadata-providers.xml</value>
</util:list>
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index ca61fcf9..4c33c54a 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -11,6 +11,30 @@
<!-- System beans needed for extension to function, loaded after global.xml -->
+ <!-- OIDC authentication context class reference parent declaration -->
+ <bean id="shibboleth.OIDCAuthnContextClassReference" abstract="true"
+ class="org.geant.idpextension.oidc.authn.principal.AuthenticationContextClassReferencePrincipal" />
+
+ <!-- OIDC client information resolver service beans. -->
+
+ <bean id="shibboleth.ClientInformationResolverService"
+ class="net.shibboleth.ext.spring.service.ReloadableSpringService"
+ depends-on="shibboleth.AttributeResolverService"
+ p:serviceConfigurations-ref="shibboleth.ClientInformationResolverResources"
+ p:failFast="%{idp.service.metadata.failFast:%{idp.service.failFast:false}}"
+ p:reloadCheckDelay="%{idp.service.metadata.checkInterval:PT0S}"
+ p:beanFactoryPostProcessors-ref="shibboleth.PropertySourcesPlaceholderConfigurer">
+ <constructor-arg name="claz"
+ value="org.geant.idpextension.oidc.metadata.resolver.ClientInformationResolver" />
+ <constructor-arg name="strategy">
+ <bean class="org.geant.idpextension.oidc.profile.spring.relyingparty.metadata.impl.ClientInformationResolverServiceStrategy" />
+ </constructor-arg>
+ </bean>
+
+ <bean id="shibboleth.ClientInformationResolver"
+ class="org.geant.idpextension.oidc.metadata.impl.ReloadingRelyingPartyClientInformationProvider"
+ c:resolverService-ref="shibboleth.ClientInformationResolverService" />
+
<!-- Necessary for encoder parsing and claims mapping to function, normally part of registry wiring. -->
<bean id="shibboleth.OIDCByteTranscoder"
@@ -28,4 +52,62 @@
</constructor-arg>
</bean>
+ <!-- Flow control beans. -->
+
+ <bean id="shibboleth.oidc.DefaultIDTokenReservedClaimNames" lazy-init="true"
+ class="org.springframework.beans.factory.config.ListFactoryBean">
+ <property name="sourceList">
+ <list>
+ <value>aud</value>
+ <value>iss</value>
+ <value>sub</value>
+ <value>iat</value>
+ <value>exp</value>
+ <value>acr</value>
+ <value>aud</value>
+ <value>auth_time</value>
+ <value>at_hash</value>
+ <value>c_hash</value>
+ <value>nonce</value>
+ </list>
+ </property>
+ </bean>
+
+ <bean id="shibboleth.oidc.DefaultUserInfoReservedClaimNames" lazy-init="true"
+ class="org.springframework.beans.factory.config.ListFactoryBean">
+ <property name="sourceList">
+ <list>
+ <value>aud</value>
+ <value>iss</value>
+ <value>sub</value>
+ </list>
+ </property>
+ </bean>
+
+ <!-- Utilities. -->
+
+ <!-- Returns true if resolver is executed in authz endpoint. -->
+ <bean id="shibboleth.oidc.Conditions.SubjectRequired"
+ class="org.geant.idpextension.oidc.profile.logic.SubjectActivationCondition" />
+
+ <!-- Returns true if client has registered public subject and resolver is executed in authz endpoint -->
+ <bean id="shibboleth.oidc.Conditions.PublicRequired" parent="shibboleth.Conditions.AND">
+ <constructor-arg>
+ <list>
+ <bean class="org.geant.idpextension.oidc.profile.logic.SubjectActivationCondition" />
+ <bean class="org.geant.idpextension.oidc.profile.logic.PublicSubjectActivationCondition" />
+ </list>
+ </constructor-arg>
+ </bean>
+
+ <!-- Returns true if client has registered pairwise subject and resolver is executed in authz endpoint -->
+ <bean id="shibboleth.oidc.Conditions.PairwiseRequired" parent="shibboleth.Conditions.AND">
+ <constructor-arg>
+ <list>
+ <bean class="org.geant.idpextension.oidc.profile.logic.SubjectActivationCondition" />
+ <bean class="org.geant.idpextension.oidc.profile.logic.PairwiseSubjectActivationCondition" />
+ </list>
+ </constructor-arg>
+ </bean>
+
</beans>
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
index 086dae35..436d4a3a 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
@@ -236,7 +236,7 @@
class="org.geant.idpextension.oidc.profile.impl.AddAttributesToClaimsSet" scope="prototype"
p:targetIDToken="true"
p:transcoderRegistry-ref="shibboleth.AttributeRegistryService"
- p:reservedClaimNames-ref="shibboleth.oidc.IDTokenReservedClaimNames">
+ p:reservedClaimNames="#{getObject('shibboleth.oidc.IDTokenReservedClaimNames') ?: getObject('shibboleth.oidc.DefaultIDTokenReservedClaimNames')}">
<property name="activationCondition">
<ref bean="IDTokenRequested" />
</property>
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
index f18b536b..43333d55 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
@@ -147,7 +147,7 @@
class="org.geant.idpextension.oidc.profile.impl.AddAttributesToClaimsSet" scope="prototype"
p:targetIDToken="true"
p:transcoderRegistry-ref="shibboleth.AttributeRegistryService"
- p:reservedClaimNames-ref="shibboleth.oidc.IDTokenReservedClaimNames" />
+ p:reservedClaimNames="#{getObject('shibboleth.oidc.IDTokenReservedClaimNames') ?: getObject('shibboleth.oidc.DefaultIDTokenReservedClaimNames')}" />
<bean id="AddTokenDeliveryAttributesToIDToken"
class="org.geant.idpextension.oidc.profile.impl.AddTokenDeliveryAttributesToClaimsSet" scope="prototype"
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/token-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/token-beans.xml
index 89bfaacb..7a25059a 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/token-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/token-beans.xml
@@ -100,7 +100,7 @@
class="org.geant.idpextension.oidc.profile.impl.AddAttributesToClaimsSet" scope="prototype"
p:responseClaimsSetLookupStrategy-ref="shibboleth.UserInfoResponseClaimsSetLookupStrategy"
p:transcoderRegistry-ref="shibboleth.AttributeRegistryService"
- p:reservedClaimNames-ref="shibboleth.oidc.UserInfoReservedClaimNames" />
+ p:reservedClaimNames="#{getObject('shibboleth.oidc.UserInfoReservedClaimNames') ?: getObject('shibboleth.oidc.DefaultUserInfoReservedClaimNames')}" />
<bean id="AddTokenDeliveryAttributesToUserinfo"
class="org.geant.idpextension.oidc.profile.impl.AddTokenDeliveryAttributesToClaimsSet"
diff --git a/idp-oidc-extension-impl/src/test/resources/conf/attribute-resolver.xml b/idp-oidc-extension-impl/src/test/resources/conf/attribute-resolver.xml
index 403dc4cd..0b08b188 100644
--- a/idp-oidc-extension-impl/src/test/resources/conf/attribute-resolver.xml
+++ b/idp-oidc-extension-impl/src/test/resources/conf/attribute-resolver.xml
@@ -78,7 +78,7 @@
<!-- Subject Identifier is a attribute that must always be resolved.
There has to be exactly one resolved and filtered attribute that would be encoded as 'sub'.
This example attribute (the data connector actually ) will generate public or pairwise 'sub' depending on client registration data. -->
- <AttributeDefinition id="subject" xsi:type="Simple" activationConditionRef="SubjectRequired">
+ <AttributeDefinition id="subject" xsi:type="Simple" activationConditionRef="shibboleth.oidc.Conditions.SubjectRequired">
<InputDataConnector ref="computedSubjectId" attributeNames="subjectId"/>
<AttributeEncoder xsi:type="oidcext:OIDCString" name="sub" />
</AttributeDefinition>
diff --git a/idp-oidc-extension-impl/src/test/resources/conf/global-oidc.xml b/idp-oidc-extension-impl/src/test/resources/conf/global-oidc.xml
index 94cab6e5..340f4252 100644
--- a/idp-oidc-extension-impl/src/test/resources/conf/global-oidc.xml
+++ b/idp-oidc-extension-impl/src/test/resources/conf/global-oidc.xml
@@ -34,49 +34,4 @@
class="org.geant.idpextension.oidc.metadata.impl.PropertiesClientSecretValueResolver"
p:resource="%{idp.oidc.metadata.clientSecretProperties}" />
- <!-- Returns true unless subject is already populated in oidc response context. -->
- <bean id="SubjectRequired" class="org.geant.idpextension.oidc.profile.logic.SubjectActivationCondition" />
-
- <!-- Returns true if client has registered public subject and subject is not already populated in oidc response context -->
- <bean id="PublicRequired" parent="shibboleth.Conditions.AND">
- <constructor-arg>
- <list>
- <bean class="org.geant.idpextension.oidc.profile.logic.SubjectActivationCondition" />
- <bean class="org.geant.idpextension.oidc.profile.logic.PublicSubjectActivationCondition" />
- </list>
- </constructor-arg>
- </bean>
-
- <!-- Returns true if client has registered pairwise subject and subject is not already populated in oidc response context -->
- <bean id="PairwiseRequired" parent="shibboleth.Conditions.AND">
- <constructor-arg>
- <list>
- <bean class="org.geant.idpextension.oidc.profile.logic.SubjectActivationCondition" />
- <bean class="org.geant.idpextension.oidc.profile.logic.PairwiseSubjectActivationCondition" />
- </list>
- </constructor-arg>
- </bean>
-
- <!-- List of reserved claims that will not be populated to id token using standard user claim population mechanisms -->
- <util:list id="shibboleth.oidc.IDTokenReservedClaimNames">
- <value>aud</value>
- <value>iss</value>
- <value>sub</value>
- <value>iat</value>
- <value>exp</value>
- <value>acr</value>
- <value>aud</value>
- <value>auth_time</value>
- <value>at_hash</value>
- <value>c_hash</value>
- <value>nonce</value>
- </util:list>
-
- <!-- List of reserved claims that will not be populated to user info response using standard user claim population mechanisms -->
- <util:list id="shibboleth.oidc.UserInfoReservedClaimNames">
- <value>aud</value>
- <value>iss</value>
- <value>sub</value>
- </util:list>
-
</beans>
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/test/resources/conf/services-oidc.xml b/idp-oidc-extension-impl/src/test/resources/conf/services-oidc.xml
index 9b34ae97..734c6ff4 100644
--- a/idp-oidc-extension-impl/src/test/resources/conf/services-oidc.xml
+++ b/idp-oidc-extension-impl/src/test/resources/conf/services-oidc.xml
@@ -13,25 +13,6 @@
This file should be imported to services.xml
-->
- <bean id="shibboleth.ClientInformationResolverService"
- class="net.shibboleth.ext.spring.service.ReloadableSpringService"
- depends-on="shibboleth.AttributeResolverService"
- p:serviceConfigurations-ref="shibboleth.ClientInformationResolverResources"
- p:failFast="%{idp.service.metadata.failFast:%{idp.service.failFast:false}}"
- p:reloadCheckDelay="%{idp.service.metadata.checkInterval:PT0S}"
- p:beanFactoryPostProcessors-ref="shibboleth.PropertySourcesPlaceholderConfigurer">
- <constructor-arg name="claz"
- value="org.geant.idpextension.oidc.metadata.resolver.ClientInformationResolver" />
- <constructor-arg name="strategy">
- <bean
- class="org.geant.idpextension.oidc.profile.spring.relyingparty.metadata.impl.ClientInformationResolverServiceStrategy" />
- </constructor-arg>
- </bean>
-
- <bean id="shibboleth.ClientInformationResolver"
- class="org.geant.idpextension.oidc.metadata.impl.ReloadingRelyingPartyClientInformationProvider"
- c:resolverService-ref="shibboleth.ClientInformationResolverService" />
-
<util:list id="shibboleth.ClientInformationResolverResources">
<value>%{idp.home}/conf/oidc-metadata-providers.xml</value>
</util:list>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list