[java-idp-oidc] branch main updated: JOIDC-15 - Reduce manual configuration integration touchpoints with IdP
Scott Cantor
cantor.2 at osu.edu
Tue Nov 10 00:00:25 UTC 2020
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=8c15b17ece9f80ab5924250215387a9977857b1b
The following commit(s) were added to refs/heads/main by this push:
new 8c15b17e JOIDC-15 - Reduce manual configuration integration touchpoints with IdP
8c15b17e is described below
commit 8c15b17ece9f80ab5924250215387a9977857b1b
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Nov 9 18:59:22 2020 -0500
JOIDC-15 - Reduce manual configuration integration touchpoints with IdP
https://issues.shibboleth.net/jira/browse/JOIDC-15
Redo client information resolver config.
---
.../src/main/resources/conf/idp-oidc.properties | 4 --
.../resources/conf/oidc-clientinfo-resolvers.xml | 35 +++++++++++++
.../resources/conf/oidc-metadata-providers.xml | 61 ----------------------
.../src/main/resources/conf/services-oidc.xml | 20 -------
.../impl/ChainingClientInformationResolver.java | 4 +-
.../META-INF/net.shibboleth.idp/postconfig.xml | 16 +++++-
.../oidc/op/conf/clientinfo-resolver-system.xml} | 32 +++++-------
.../src/test/resources/conf/idp-oidc.properties | 2 -
.../resources/conf/oidc-clientinfo-resolvers.xml | 22 ++++++++
.../src/test/resources/conf/services-oidc.xml | 20 -------
.../src/test/resources/conf/services.xml | 6 ---
11 files changed, 87 insertions(+), 135 deletions(-)
diff --git a/idp-oidc-extension-distribution/src/main/resources/conf/idp-oidc.properties b/idp-oidc-extension-distribution/src/main/resources/conf/idp-oidc.properties
index 2938f1d5..4a2957a3 100644
--- a/idp-oidc-extension-distribution/src/main/resources/conf/idp-oidc.properties
+++ b/idp-oidc-extension-distribution/src/main/resources/conf/idp-oidc.properties
@@ -2,8 +2,6 @@
idp.oidc.issuer = https://your.issuer.example.com
#Dynamic registration properties
-# Storage for client registration data. Set to persistent storage if required to preserve between restarts.
-#idp.oidc.dynreg.StorageService = shibboleth.StorageService
# The validity of registration before a new one is required.
#idp.oidc.dynreg.defaultRegistrationValidity = PT24H
# The validity of client secret registered
@@ -45,7 +43,5 @@ idp.signing.oidc.rsa.enc.key = %{idp.home}/credentials/idp-encryption-rsa.jwk
#idp.oidc.forcePKCE = false
#idp.oidc.allowPKCEPlain = false
-idp.service.attribute.registry.namingRegistry = OIDCExtendedNamingRegistry
-
# Reference to a global bean defining the dynamic contents for the openid-configuration
#idp.oidc.discovery.resolver = shibboleth.oidc.DefaultOpenIdConfigurationResolver
diff --git a/idp-oidc-extension-distribution/src/main/resources/conf/oidc-clientinfo-resolvers.xml b/idp-oidc-extension-distribution/src/main/resources/conf/oidc-clientinfo-resolvers.xml
new file mode 100644
index 00000000..d8194b0a
--- /dev/null
+++ b/idp-oidc-extension-distribution/src/main/resources/conf/oidc-clientinfo-resolvers.xml
@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:context="http://www.springframework.org/schema/context"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:c="http://www.springframework.org/schema/c"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+
+ default-init-method="initialize"
+ default-destroy-method="destroy"
+ default-lazy-init="true">
+
+ <!--
+ The following example contains two OIDC client information resolvers:
+ - first one reading a single client's information from a JSON file
+ - second one fetching client information from a configured StorageService
+ -->
+
+ <util:list id="shibboleth.oidc.ClientInformationResolvers">
+ <!-- <ref bean="ExampleFileResolver" /> -->
+ <ref bean="ExampleStorageClientInformationResolver" />
+ </util:list>
+
+ <!--
+ <bean id="ExampleFileResolver" parent="shibboleth.oidc.FilesystemClientInformationResolver"
+ c:metadata="/opt/shibboleth-idp/metadata/oidc-client.json" />
+ -->
+
+ <bean id="ExampleStorageClientInformationResolver" parent="shibboleth.oidc.StorageClientInformationResolver"
+ p:storageService-ref="shibboleth.StorageService" />
+
+</beans>
diff --git a/idp-oidc-extension-distribution/src/main/resources/conf/oidc-metadata-providers.xml b/idp-oidc-extension-distribution/src/main/resources/conf/oidc-metadata-providers.xml
deleted file mode 100644
index 8c190f3f..00000000
--- a/idp-oidc-extension-distribution/src/main/resources/conf/oidc-metadata-providers.xml
+++ /dev/null
@@ -1,61 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
- xmlns:context="http://www.springframework.org/schema/context"
- xmlns:util="http://www.springframework.org/schema/util"
- xmlns:p="http://www.springframework.org/schema/p"
- xmlns:c="http://www.springframework.org/schema/c"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-
- default-init-method="initialize"
- default-destroy-method="destroy"
- default-lazy-init="true">
-
- <!-- Generic beans for configuring the OIDC metadata system, in most cases don't need any modifications. -->
-
- <bean id="shibboleth.oidc.RelyingPartyClientInformationProvider" lazy-init="false"
- class="org.geant.idpextension.oidc.metadata.resolver.RelyingPartyClientInformationProvider"
- p:embeddedResolver-ref="shibboleth.oidc.ChainingClientInformationResolver">
- </bean>
-
- <bean id="shibboleth.oidc.RemoteJwkSetCache"
- class="org.geant.idpextension.oidc.metadata.resolver.RemoteJwkSetCache"
- p:storage-ref="#{'%{idp.oidc.jwk.StorageService:shibboleth.StorageService}'.trim()}"
- p:httpClient="#{getObject('shibboleth.oidc.NonBrowser.HttpClient') ?: getObject('shibboleth.InternalHttpClient')}"
- p:httpClientSecurityParameters="#{getObject('shibboleth.oidc.NonBrowser.HttpClientSecurityParameters')}" />
-
- <bean id="shibboleth.oidc.ChainingClientInformationResolver"
- class="org.geant.idpextension.oidc.metadata.impl.ChainingClientInformationResolver"
- p:id="InternalEmbeddedChainResolver"
- p:resolvers-ref="shibboleth.oidc.ClientInformationResolvers"/>
-
- <!-- Generic beans end, in most cases only edit after this line. -->
-
- <!-- The following example contains two OIDC client information resolvers: first one reading a single client information from a JSON file, and the
- second one fetchs the OIDC client informations from the configured StorageService. -->
-
- <util:list id="shibboleth.oidc.ClientInformationResolvers"
- value-type="org.geant.idpextension.oidc.metadata.resolver.ClientInformationResolver">
-<!--
- <ref bean="ExampleFileResolver" />
--->
- <ref bean="ExampleStorageClientInformationResolver" />
- </util:list>
-
-<!--
- <bean id="ExampleFileResolver"
- class="org.geant.idpextension.oidc.metadata.impl.FilesystemClientInformationResolver"
- p:id="ExampleFileResolver1"
- p:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache" c:metadata="/opt/shibboleth-idp/metadata/oidc-client.json" />
--->
-
- <bean id="ExampleStorageClientInformationResolver"
- class="org.geant.idpextension.oidc.metadata.impl.StorageServiceClientInformationResolver"
- p:id="ExampleStorageResolver1"
- p:storageService-ref="#{'%{idp.oidc.dynreg.StorageService:shibboleth.StorageService}'.trim()}"
- p:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache"/>
-
-</beans>
-
diff --git a/idp-oidc-extension-distribution/src/main/resources/conf/services-oidc.xml b/idp-oidc-extension-distribution/src/main/resources/conf/services-oidc.xml
deleted file mode 100755
index 734c6ff4..00000000
--- a/idp-oidc-extension-distribution/src/main/resources/conf/services-oidc.xml
+++ /dev/null
@@ -1,20 +0,0 @@
-<beans xmlns="http://www.springframework.org/schema/beans"
- xmlns:context="http://www.springframework.org/schema/context"
- xmlns:util="http://www.springframework.org/schema/util" xmlns:p="http://www.springframework.org/schema/p"
- xmlns:c="http://www.springframework.org/schema/c" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-
- default-init-method="initialize" default-destroy-method="destroy">
-
- <!--
- This file contains oidc services.
- This file should be imported to services.xml
- -->
-
- <util:list id="shibboleth.ClientInformationResolverResources">
- <value>%{idp.home}/conf/oidc-metadata-providers.xml</value>
- </util:list>
-
-</beans>
diff --git a/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/metadata/impl/ChainingClientInformationResolver.java b/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/metadata/impl/ChainingClientInformationResolver.java
index c10a4ff5..4429b649 100644
--- a/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/metadata/impl/ChainingClientInformationResolver.java
+++ b/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/metadata/impl/ChainingClientInformationResolver.java
@@ -67,7 +67,7 @@ public class ChainingClientInformationResolver extends AbstractIdentifiableIniti
* @return list of currently registered resolvers
*/
@Nonnull @NonnullElements @Unmodifiable @NotLive public List<ClientInformationResolver> getResolvers() {
- return List.copyOf(resolvers);
+ return resolvers;
}
/**
@@ -77,7 +77,7 @@ public class ChainingClientInformationResolver extends AbstractIdentifiableIniti
*
* @throws ResolverException thrown if there is a problem adding the client information resolvers
*/
- public void setResolvers(@Nonnull @NonnullElements final List<? extends ClientInformationResolver> newResolvers)
+ public void setResolvers(@Nullable @NonnullElements final List<? extends ClientInformationResolver> newResolvers)
throws ResolverException {
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 87b3e329..05a43465 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -27,9 +27,10 @@
<bean id="shibboleth.ClientInformationResolverService"
class="net.shibboleth.ext.spring.service.ReloadableSpringService"
depends-on="shibboleth.AttributeResolverService"
- p:serviceConfigurations-ref="shibboleth.ClientInformationResolverResources"
+ p:serviceConfigurations-ref="ExtendedClientInformationResolverResources"
p:failFast="%{idp.service.metadata.failFast:%{idp.service.failFast:false}}"
p:reloadCheckDelay="%{idp.service.metadata.checkInterval:PT0S}"
+ p:beanPostProcessors-ref="shibboleth.IdentifiableBeanPostProcessor"
p:beanFactoryPostProcessors-ref="shibboleth.PropertySourcesPlaceholderConfigurer">
<constructor-arg name="claz"
value="org.geant.idpextension.oidc.metadata.resolver.ClientInformationResolver" />
@@ -37,6 +38,19 @@
<bean class="org.geant.idpextension.oidc.profile.spring.relyingparty.metadata.impl.ClientInformationResolverServiceStrategy" />
</constructor-arg>
</bean>
+ <util:list id="shibboleth.DefaultClientInformationResolverResources">
+ <value>conditional:%{idp.home}/conf/oidc-clientinfo-resolvers.xml</value>
+ </util:list>
+ <!-- Auto-append system config file to resource set. -->
+ <bean id ="ExtendedClientInformationResolverResources" class="net.shibboleth.ext.spring.factory.CombiningListFactoryBean"
+ p:firstList="#{getObject('%{idp.service.clientinfo.resources:shibboleth.ClientInformationResolverResources}'.trim()) ?:
+ getObject('shibboleth.DefaultClientInformationResolverResources')}">
+ <property name="secondList">
+ <util:list >
+ <value>classpath:/net/shibboleth/idp/plugin/oidc/op/conf/clientinfo-resolver-system.xml</value>
+ </util:list>
+ </property>
+ </bean>
<bean id="shibboleth.ClientInformationResolver"
class="org.geant.idpextension.oidc.metadata.impl.ReloadingRelyingPartyClientInformationProvider"
diff --git a/idp-oidc-extension-impl/src/test/resources/conf/oidc-metadata-providers.xml b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/clientinfo-resolver-system.xml
similarity index 66%
rename from idp-oidc-extension-impl/src/test/resources/conf/oidc-metadata-providers.xml
rename to idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/clientinfo-resolver-system.xml
index a596b18b..367f10a1 100644
--- a/idp-oidc-extension-impl/src/test/resources/conf/oidc-metadata-providers.xml
+++ b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/clientinfo-resolver-system.xml
@@ -10,11 +10,10 @@
http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
default-init-method="initialize"
- default-destroy-method="destroy">
+ default-destroy-method="destroy"
+ default-lazy-init="true">
- <!-- Generic beans for configuring the OIDC metadata system, in most cases don't need any modifications. -->
-
- <bean id="shibboleth.oidc.RelyingPartyClientInformationProvider"
+ <bean id="shibboleth.oidc.RelyingPartyClientInformationProvider" lazy-init="false"
class="org.geant.idpextension.oidc.metadata.resolver.RelyingPartyClientInformationProvider"
p:embeddedResolver-ref="shibboleth.oidc.ChainingClientInformationResolver">
</bean>
@@ -28,22 +27,17 @@
<bean id="shibboleth.oidc.ChainingClientInformationResolver"
class="org.geant.idpextension.oidc.metadata.impl.ChainingClientInformationResolver"
p:id="InternalEmbeddedChainResolver"
- p:resolvers-ref="shibboleth.oidc.ClientInformationResolvers"/>
-
- <!-- Generic beans end, in most cases only edit after this line. -->
-
- <!-- The following example contains two OIDC client information resolvers: first one reading a single client information from a JSON file, and the
- second one fetchs the OIDC client informations from the configured StorageService. -->
+ p:resolvers="#{getObject('shibboleth.oidc.ClientInformationResolvers')}"/>
- <util:list id="shibboleth.oidc.ClientInformationResolvers"
- value-type="org.geant.idpextension.oidc.metadata.resolver.ClientInformationResolver">
- <ref bean="ExampleStorageClientInformationResolver" />
- </util:list>
+ <bean id="shibboleth.oidc.FilesystemClientInformationResolver" abstract="true"
+ class="org.geant.idpextension.oidc.metadata.impl.FilesystemClientInformationResolver"
+ p:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache" />
- <bean id="ExampleStorageClientInformationResolver"
+ <bean id="shibboleth.oidc.StorageClientInformationResolver" abstract="true"
class="org.geant.idpextension.oidc.metadata.impl.StorageServiceClientInformationResolver"
- p:id="ExampleStorageResolver1"
- p:storageService-ref="#{'%{idp.oidc.dynreg.StorageService:shibboleth.StorageService}'.trim()}"
p:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache"/>
-
-</beans>
\ No newline at end of file
+
+ <!-- Wildcard import hook for plugins. -->
+ <import resource="classpath*:/META-INF/net/shibboleth/idp/plugin/oidc/op/service/clientinfo/postconfig.xml" />
+
+</beans>
diff --git a/idp-oidc-extension-impl/src/test/resources/conf/idp-oidc.properties b/idp-oidc-extension-impl/src/test/resources/conf/idp-oidc.properties
index 60fe276a..44919f18 100644
--- a/idp-oidc-extension-impl/src/test/resources/conf/idp-oidc.properties
+++ b/idp-oidc-extension-impl/src/test/resources/conf/idp-oidc.properties
@@ -6,6 +6,4 @@ idp.oidc.subject.sourceAttribute = uid
idp.oidc.subject.salt = isfd07fsddfs70sdf9d99s8
idp.oidc.discovery.template = src/test/resources/conf/openid-configuration.json
-idp.service.attribute.registry.namingRegistry=OIDCExtendedNamingRegistry
-
idp.oidc.metadata.clientSecretProperties = classpath:/org/geant/idpextension/oidc/metadata/impl/client-secret-test.properties
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/test/resources/conf/oidc-clientinfo-resolvers.xml b/idp-oidc-extension-impl/src/test/resources/conf/oidc-clientinfo-resolvers.xml
new file mode 100644
index 00000000..b181076c
--- /dev/null
+++ b/idp-oidc-extension-impl/src/test/resources/conf/oidc-clientinfo-resolvers.xml
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:context="http://www.springframework.org/schema/context"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:c="http://www.springframework.org/schema/c"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+
+ default-init-method="initialize"
+ default-destroy-method="destroy">
+
+ <util:list id="shibboleth.oidc.ClientInformationResolvers">
+ <ref bean="ExampleStorageClientInformationResolver" />
+ </util:list>
+
+ <bean id="ExampleStorageClientInformationResolver" parent="shibboleth.oidc.StorageClientInformationResolver"
+ p:storageService-ref="shibboleth.StorageService" />
+
+</beans>
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/test/resources/conf/services-oidc.xml b/idp-oidc-extension-impl/src/test/resources/conf/services-oidc.xml
deleted file mode 100644
index 734c6ff4..00000000
--- a/idp-oidc-extension-impl/src/test/resources/conf/services-oidc.xml
+++ /dev/null
@@ -1,20 +0,0 @@
-<beans xmlns="http://www.springframework.org/schema/beans"
- xmlns:context="http://www.springframework.org/schema/context"
- xmlns:util="http://www.springframework.org/schema/util" xmlns:p="http://www.springframework.org/schema/p"
- xmlns:c="http://www.springframework.org/schema/c" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-
- default-init-method="initialize" default-destroy-method="destroy">
-
- <!--
- This file contains oidc services.
- This file should be imported to services.xml
- -->
-
- <util:list id="shibboleth.ClientInformationResolverResources">
- <value>%{idp.home}/conf/oidc-metadata-providers.xml</value>
- </util:list>
-
-</beans>
diff --git a/idp-oidc-extension-impl/src/test/resources/conf/services.xml b/idp-oidc-extension-impl/src/test/resources/conf/services.xml
index 7e96f389..c2cf11ce 100644
--- a/idp-oidc-extension-impl/src/test/resources/conf/services.xml
+++ b/idp-oidc-extension-impl/src/test/resources/conf/services.xml
@@ -8,8 +8,6 @@
default-init-method="initialize"
default-destroy-method="destroy">
-
- <import resource="services-oidc.xml" />
<!-- Advanced configuration of services from HTTP.
@@ -82,10 +80,6 @@
<value>%{idp.home}/conf/access-control.xml</value>
</util:list>
- <util:list id="shibboleth.CASServiceRegistryResources">
- <value>%{idp.home}/conf/cas-protocol.xml</value>
- </util:list>
-
<!--
This collection of resources differs slightly in that it should not include the file extension.
Message sources are internationalized, and Spring will search for a compatible language extension
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list