[java-idp-oidc] branch main updated: JOIDC-15 - Reduce manual configuration integration touchpoints with IdP
Scott Cantor
cantor.2 at osu.edu
Tue Nov 24 15:59:19 UTC 2020
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=450a72c2800faf54e5cf8c4705fdd3f453e1a59e
The following commit(s) were added to refs/heads/main by this push:
new 450a72c2 JOIDC-15 - Reduce manual configuration integration touchpoints with IdP
450a72c2 is described below
commit 450a72c2800faf54e5cf8c4705fdd3f453e1a59e
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Nov 24 10:59:17 2020 -0500
JOIDC-15 - Reduce manual configuration integration touchpoints with IdP
https://issues.shibboleth.net/jira/browse/JOIDC-15
File renaming.
Move managed config into jar and define to module.
---
.../src/assembly/dep.xml | 12 --
.../src/main/resources/views/login-oidc-example.vm | 159 ---------------------
.../idp/service/relying-party/postconfig.xml | 8 +-
.../plugin/oidc/op/conf/oidc-attribute-filter.xml | 0
.../oidc/op}/conf/oidc-clientinfo-resolvers.xml | 0
.../idp/plugin/oidc/op/conf/oidc-credentials.xml | 6 +-
.../idp/plugin/oidc/op/conf/oidc.properties | 0
.../idp/plugin/oidc/op/module.properties | 25 ++--
.../src/test/resources/conf/credentials.xml | 2 +-
.../src/test/resources/conf/idp.properties | 2 +-
.../{credentials-oidc.xml => oidc-credentials.xml} | 33 +++--
.../conf/{idp-oidc.properties => oidc.properties} | 0
12 files changed, 44 insertions(+), 203 deletions(-)
diff --git a/idp-oidc-extension-distribution/src/assembly/dep.xml b/idp-oidc-extension-distribution/src/assembly/dep.xml
index d7f2b435..efc9629b 100644
--- a/idp-oidc-extension-distribution/src/assembly/dep.xml
+++ b/idp-oidc-extension-distribution/src/assembly/dep.xml
@@ -8,13 +8,6 @@
<format>zip</format>
</formats>
<fileSets>
- <fileSet>
- <directory>../idp-oidc-extension-impl/src/main/resources/flows</directory>
- <outputDirectory>flows</outputDirectory>
- <includes>
- <include>**/*</include>
- </includes>
- </fileSet>
<fileSet>
<directory>../idp-oidc-extension-impl/target/dependency</directory>
<outputDirectory>webapp/WEB-INF/lib</outputDirectory>
@@ -48,11 +41,6 @@
<directory>src/main/resources/</directory>
<outputDirectory></outputDirectory>
<includes>
- <include>conf/*</include>
- <include>conf/authn/*</include>
- <include>bin/*</include>
- <include>views/*</include>
- <include>static/.well-known/*</include>
<include>bootstrap/*</include>
</includes>
</fileSet>
diff --git a/idp-oidc-extension-distribution/src/main/resources/views/login-oidc-example.vm b/idp-oidc-extension-distribution/src/main/resources/views/login-oidc-example.vm
deleted file mode 100644
index e84ff056..00000000
--- a/idp-oidc-extension-distribution/src/main/resources/views/login-oidc-example.vm
+++ /dev/null
@@ -1,159 +0,0 @@
-##
-## Velocity Template for DisplayUsernamePasswordPage view-state
-##
-## Velocity context will contain the following properties
-## flowExecutionUrl - the form action location
-## flowRequestContext - the Spring Web Flow RequestContext
-## flowExecutionKey - the SWF execution key (this is built into the flowExecutionUrl)
-## profileRequestContext - root of context tree
-## authenticationContext - context with authentication request information
-## authenticationErrorContext - context with login error state
-## authenticationWarningContext - context with login warning state
-## ldapResponseContext - context with LDAP state (if using native LDAP)
-## rpUIContext - the context with SP UI information from the metadata
-## extendedAuthenticationFlows - collection of "extended" AuthenticationFlowDescriptor objects
-## passwordPrincipals - contents of the shibboleth.authn.Password.PrincipalOverride bean
-## encoder - HTMLEncoder class
-## request - HttpServletRequest
-## response - HttpServletResponse
-## environment - Spring Environment object for property resolution
-## custom - arbitrary object injected by deployer
-##
-#set ($rpContext = $profileRequestContext.getSubcontext('net.shibboleth.idp.profile.context.RelyingPartyContext'))
-#set ($username = $authenticationContext.getSubcontext('net.shibboleth.idp.authn.context.UsernamePasswordContext', true).getUsername())
-#set ($passwordEnabled = false)
-#if (!$passwordPrincipals or $passwordPrincipals.isEmpty() or $authenticationContext.isAcceptable($passwordPrincipals))
- #set ($passwordEnabled = true)
-#end
-##
-<!DOCTYPE html>
-<html>
- <head>
- <meta charset="utf-8">
- <meta name="viewport" content="width=device-width,initial-scale=1.0">
- <title>#springMessageText("idp.title", "Web Login Service")</title>
- <link rel="stylesheet" type="text/css" href="$request.getContextPath()/css/main.css">
- </head>
- <body>
- <div class="wrapper">
- <div class="container">
- <header>
- <img src="$request.getContextPath()#springMessage("idp.logo")" alt="#springMessageText("idp.logo.alt-text", "logo")">
- </header>
-
- <div class="content">
- <div class="column one">
- #parse("login-error.vm")
-
- <form action="$flowExecutionUrl" method="post">
-
- #set ($serviceName = $rpUIContext.serviceName)
- #if ($serviceName && !$rpContext.getRelyingPartyId().contains($serviceName))
- <legend>
- #springMessageText("idp.login.loginTo", "Login to") $encoder.encodeForHTML($serviceName)
- </legend>
- #end
-
- #if ($passwordEnabled)
- <div class="form-element-wrapper">
- <label for="username">#springMessageText("idp.login.username", "Username")</label>
- <input class="form-element form-field" id="username" name="j_username" type="text"
- value="#if($username)$encoder.encodeForHTML($username)#end">
- </div>
-
- <div class="form-element-wrapper">
- <label for="password">#springMessageText("idp.login.password", "Password")</label>
- <input class="form-element form-field" id="password" name="j_password" type="password" value="">
- </div>
-
- ## You may need to modify this to taste, such as changing the flow name its checking for to authn/MFA.
- #if (!$authenticationContext.getActiveResults().containsKey('authn/Password'))
- <div class="form-element-wrapper">
- <input type="checkbox" name="donotcache" value="1" id="donotcache">
- <label for="donotcache">#springMessageText("idp.login.donotcache", "Don't Remember Login")</label>
- </div>
- #end
-
- #end
-
- <div class="form-element-wrapper">
- <input id="_shib_idp_revokeConsent" type="checkbox" name="_shib_idp_revokeConsent" value="true">
- <label for="_shib_idp_revokeConsent">#springMessageText("idp.attribute-release.revoke", "Clear prior granting of permission for release of your information to this service.")</label>
- </div>
-
- #if ($passwordEnabled)
- <div class="form-element-wrapper">
- <button class="form-element form-button" type="submit" name="_eventId_proceed"
- onClick="this.childNodes[0].nodeValue='#springMessageText("idp.login.pleasewait", "Logging in, please wait...")'"
- >#springMessageText("idp.login.login", "Login")</button>
- </div>
- #end
-
- #foreach ($extFlow in $extendedAuthenticationFlows)
- #if ($authenticationContext.isAcceptable($extFlow) and $extFlow.apply(profileRequestContext))
- <div class="form-element-wrapper">
- <button class="form-element form-button" type="submit" name="_eventId_$extFlow.getId()">
- #springMessageText("idp.login.$extFlow.getId().replace('authn/','')", $extFlow.getId().replace('authn/',''))
- </button>
- </div>
- #end
- #end
- </form>
-
- #*
- //
- // SP Description & Logo (optional)
- // These idpui lines will display added information (if available
- // in the metadata) about the Service Provider (SP) that requested
- // authentication. These idpui lines are "active" in this example
- // (not commented out) - this extra SP info will be displayed.
- // Remove or comment out these lines to stop the display of the
- // added SP information.
- //
- *#
- #set ($logo = $rpUIContext.getLogo())
- #if ($logo)
- <img src= "$encoder.encodeForHTMLAttribute($logo)"
- alt="$encoder.encodeForHTMLAttribute($serviceName)">
- #end
- #set ($desc = $rpUIContext.getServiceDescription())
- #if ($desc)
- $encoder.encodeForHTML($desc)
- #end
-
- #set ($info = $rpUIContext.getInformationURL())
- #if ($info)
- information URL: $encoder.encodeForHTML($info)
- #end
-
- #set ($privacy = $rpUIContext.getPrivacyStatementURL())
- #if ($privacy)
- privacy statement URL: $encoder.encodeForHTML($privacy)
- #end
-
- #set ($email = $rpUIContext.getContactEmail("support"))
- #if ($email)
- support contact: $encoder.encodeForHTML($email)
- #end
-
- </div>
- <div class="column two">
- <ul class="list list-help">
- #if ($passwordEnabled)
- <li class="list-help-item"><a href="#springMessageText("idp.url.password.reset", "#")"><span class="item-marker">›</span> #springMessageText("idp.login.forgotPassword", "Forgot your password?")</a></li>
- #end
- <li class="list-help-item"><a href="#springMessageText("idp.url.helpdesk", "#")"><span class="item-marker">›</span> #springMessageText("idp.login.needHelp", "Need Help?")</a></li>
- </ul>
- </div>
- </div>
- </div>
-
- <footer>
- <div class="container container-footer">
- <p class="footer-text">#springMessageText("idp.footer", "Insert your footer text here.")</p>
- </div>
- </footer>
- </div>
-
- </body>
-</html>
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index b35e0153..3b5a2a33 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -76,7 +76,7 @@
<!-- Configuration for credentials and supported algorithms for ID Token and UserInfo response signing. -->
<bean id="shibboleth.oidc.SigningConfiguration" parent="shibboleth.BasicSignatureSigningConfiguration"
- p:signingCredentials-ref="shibboleth.oidc.SigningCredentials">
+ p:signingCredentials="#{getObject('shibboleth.oidc.SigningCredentials')}">
<property name="signatureAlgorithms">
<list>
<util:constant
@@ -151,7 +151,7 @@
<!-- Configuration for credentials and supported algorithms for request object decryption. -->
<bean id="shibboleth.oidc.requestObjectDecryptionConfiguration" parent="shibboleth.BasicEncryptionConfiguration"
- p:keyTransportEncryptionCredentials-ref="shibboleth.oidc.EncryptionCredentials">
+ p:keyTransportEncryptionCredentials="#{getObject('shibboleth.oidc.EncryptionCredentials')}">
<property name="keyTransportEncryptionAlgorithms">
<list>
<util:constant
@@ -257,10 +257,10 @@
<!-- Signing keys to publish. -->
<bean id="shibboleth.oidc.PublishKeySetSigningConfiguration" parent="shibboleth.BasicSignatureSigningConfiguration"
- p:signingCredentials-ref="shibboleth.oidc.SigningCredentialsToPublish"/>
+ p:signingCredentials="#{getObject('shibboleth.oidc.SigningCredentialsToPublish') ?: getObject('shibboleth.oidc.SigningCredentials')}"/>
<!-- Encryption keys to publish. -->
<bean id="shibboleth.oidc.PublishKeySetRequestObjectDecryptionConfiguration" parent="shibboleth.BasicEncryptionConfiguration"
- p:keyTransportEncryptionCredentials-ref="shibboleth.oidc.EncryptionCredentialsToPublish"/>
+ p:keyTransportEncryptionCredentials="#{getObject('shibboleth.oidc.EncryptionCredentialsToPublish') ?: getObject('shibboleth.oidc.EncryptionCredentials')}"/>
</beans>
\ No newline at end of file
diff --git a/idp-oidc-extension-distribution/src/main/resources/conf/attribute-filter-oidc.xml b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc-attribute-filter.xml
similarity index 100%
rename from idp-oidc-extension-distribution/src/main/resources/conf/attribute-filter-oidc.xml
rename to idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc-attribute-filter.xml
diff --git a/idp-oidc-extension-distribution/src/main/resources/conf/oidc-clientinfo-resolvers.xml b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc-clientinfo-resolvers.xml
similarity index 100%
rename from idp-oidc-extension-distribution/src/main/resources/conf/oidc-clientinfo-resolvers.xml
rename to idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc-clientinfo-resolvers.xml
diff --git a/idp-oidc-extension-distribution/src/main/resources/conf/credentials-oidc.xml b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc-credentials.xml
similarity index 91%
rename from idp-oidc-extension-distribution/src/main/resources/conf/credentials-oidc.xml
rename to idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc-credentials.xml
index 9fb566ad..2bbb06e6 100644
--- a/idp-oidc-extension-distribution/src/main/resources/conf/credentials-oidc.xml
+++ b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc-credentials.xml
@@ -39,9 +39,8 @@
<!--
If you need to publish a key set different from shibboleth.oidc.EncryptionCredentials, define
- a list bean named "shibboleth.oidc.EncryptionCredentialsToPublish" in place of this alias.
+ a list bean named "shibboleth.oidc.EncryptionCredentialsToPublish".
-->
- <alias name="shibboleth.oidc.EncryptionCredentials" alias="shibboleth.oidc.EncryptionCredentialsToPublish" />
<!-- Example of two active encryption credentials, but only publishing the second before removing from use. -->
<!--
@@ -52,9 +51,8 @@
<!--
If you need to publish a key set different from shibboleth.oidc.SigningCredentials, define
- a list bean named "shibboleth.oidc.SigningCredentialsToPublish" in place of this alias.
+ a list bean named "shibboleth.oidc.SigningCredentialsToPublish".
-->
- <alias name="shibboleth.oidc.SigningCredentials" alias="shibboleth.oidc.SigningCredentialsToPublish" />
<!-- Example of publishing two signing credentials, before active use. -->
<!--
diff --git a/idp-oidc-extension-distribution/src/main/resources/conf/idp-oidc.properties b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
similarity index 100%
rename from idp-oidc-extension-distribution/src/main/resources/conf/idp-oidc.properties
rename to idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
diff --git a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/module.properties b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/module.properties
index 0db1fd48..a3bd7628 100644
--- a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/module.properties
+++ b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/module.properties
@@ -1,14 +1,21 @@
# Properties defining this module.
# Class to Module ID mappings
-net.shibboleth.idp.plugin.oidc.op.OIDCOPModule = idp.oidc.op
+net.shibboleth.idp.plugin.oidc.op.OIDCOPModule = idp.oidc.OP
# Module Owner
-idp.oidc.op.plugin = net.shibboleth.idp.plugin.oidc.op
-
-idp.oidc.op.name = OIDC OP
-idp.oidc.op.desc = OIDC Provider plugin
-i#dp.oidc.op.url = TODO
-#idp.oidc.1.src = /net/shibboleth/idp/plugin/oidc/conf/credentials-oidc.xml
-#idp.oidc.1.dest = conf/credentials-oidc.xml
-#idp.oidc.1.replace = false
+idp.oidc.OP.plugin = net.shibboleth.idp.plugin.oidc.op
+
+idp.oidc.OP.name = OIDC OP
+idp.oidc.OP.desc = OpenID Connect OP functionality
+#idp.oidc.OP.url = TODO
+idp.oidc.OP.1.src = /net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
+idp.oidc.OP.1.dest = conf/oidc.properties
+idp.oidc.OP.2.src = /net/shibboleth/idp/plugin/oidc/op/conf/oidc-clientinfo-resolvers.xml
+idp.oidc.OP.2.dest = conf/oidc-clientinfo-resolvers.xml
+idp.oidc.OP.3.src = /net/shibboleth/idp/plugin/oidc/op/conf/oidc-credentials.xml
+idp.oidc.OP.3.dest = conf/oidc-credentials.xml
+idp.oidc.OP.4.src = /net/shibboleth/idp/plugin/oidc/op/conf/oidc-attribute-filter.xml
+idp.oidc.OP.4.dest = conf/oidc-attribute-filter.xml
+
+idp.oidc.OP.postenable = See documentation for additional instructions to enable the OP module.
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/test/resources/conf/credentials.xml b/idp-oidc-extension-impl/src/test/resources/conf/credentials.xml
index b3bdcfbf..122a9d15 100644
--- a/idp-oidc-extension-impl/src/test/resources/conf/credentials.xml
+++ b/idp-oidc-extension-impl/src/test/resources/conf/credentials.xml
@@ -12,7 +12,7 @@
default-init-method="initialize"
default-destroy-method="destroy">
- <import resource="credentials-oidc.xml" />
+ <import resource="oidc-credentials.xml" />
<!--
NOTE: if you're using a legacy relying-party.xml file from a V2 configuration, this file is ignored.
diff --git a/idp-oidc-extension-impl/src/test/resources/conf/idp.properties b/idp-oidc-extension-impl/src/test/resources/conf/idp.properties
index 04f0c653..cd09a526 100644
--- a/idp-oidc-extension-impl/src/test/resources/conf/idp.properties
+++ b/idp-oidc-extension-impl/src/test/resources/conf/idp.properties
@@ -3,7 +3,7 @@
#idp.searchForProperties = false
# Load any additional property resources from a comma-delimited list
-idp.additionalProperties = /conf/ldap.properties, /conf/saml-nameid.properties, /conf/services.properties, /conf/admin/admin.properties, /conf/authn/authn.properties, /conf/authn/duo.properties, /conf/idp-oidc.properties, /credentials/secrets.properties
+idp.additionalProperties = /conf/ldap.properties, /conf/saml-nameid.properties, /conf/services.properties, /conf/admin/admin.properties, /conf/authn/authn.properties, /conf/authn/duo.properties, /conf/oidc.properties, /credentials/secrets.properties
# In most cases (and unless noted in the surrounding comments) the
# commented settings in the distributed files are the default
diff --git a/idp-oidc-extension-impl/src/test/resources/conf/credentials-oidc.xml b/idp-oidc-extension-impl/src/test/resources/conf/oidc-credentials.xml
similarity index 62%
rename from idp-oidc-extension-impl/src/test/resources/conf/credentials-oidc.xml
rename to idp-oidc-extension-impl/src/test/resources/conf/oidc-credentials.xml
index 427ea318..2bbb06e6 100644
--- a/idp-oidc-extension-impl/src/test/resources/conf/credentials-oidc.xml
+++ b/idp-oidc-extension-impl/src/test/resources/conf/oidc-credentials.xml
@@ -20,35 +20,42 @@
<bean id="shibboleth.oidc.DefaultRSAEncryptionCredential" parent="shibboleth.JWKCredential"
p:resource="%{idp.signing.oidc.rsa.enc.key}" />
- <!-- The list of ALL of your OP's ID Token / UserInfo response signing credentials for the default security configuration.
- If you define additional signing credentials, for example for new supported signing algorithms, make sure to include them
- within this list. -->
+ <!--
+ Lists ALL of your OP's response signing credentials for the default security configuration.
+ If you define additional signing credentials make sure to include them within this list.
+ -->
<util:list id="shibboleth.oidc.SigningCredentials">
<ref bean="shibboleth.oidc.DefaultRSSigningCredential" />
<ref bean="shibboleth.oidc.DefaultESSigningCredential" />
</util:list>
- <!-- The list of ALL of your OP's Request Object decryption credentials for the default security configuration. If you
- define additional decryption credentials, for example to support new algorithm, make sure to include them within
- this list. -->
+ <!--
+ Lists ALL of your OP's request decryption credentials for the default security configuration.
+ If you define additional decryption credentials make sure to include them within this list.
+ -->
<util:list id="shibboleth.oidc.EncryptionCredentials">
<ref bean="shibboleth.oidc.DefaultRSAEncryptionCredential" />
</util:list>
- <!-- If you need to publish key set different from shibboleth.oidc.EncryptionCredentials, define a list named as shibboleth.oidc.EncryptionCredentialsToPublish -->
- <alias name="shibboleth.oidc.EncryptionCredentials" alias="shibboleth.oidc.EncryptionCredentialsToPublish" />
<!--
- Example of case having two active encryption credentials but then stop publishing the second before removing it from active configuration.
+ If you need to publish a key set different from shibboleth.oidc.EncryptionCredentials, define
+ a list bean named "shibboleth.oidc.EncryptionCredentialsToPublish".
+ -->
+
+ <!-- Example of two active encryption credentials, but only publishing the second before removing from use. -->
+ <!--
<util:list id="shibboleth.oidc.EncryptionCredentialsToPublish">
<ref bean="shibboleth.oidc.OnlyNewDefaultRSAEncryptionCredential" />
</util:list>
-->
- <!-- If you need to publish key set different from shibboleth.oidc.SigningCredentials, define a list named as shibboleth.oidc.SigningCredentialsToPublish -->
- <alias name="shibboleth.oidc.SigningCredentials" alias="shibboleth.oidc.SigningCredentialsToPublish" />
<!--
- Example of case publishing signing credential before taking it to active configuration:
+ If you need to publish a key set different from shibboleth.oidc.SigningCredentials, define
+ a list bean named "shibboleth.oidc.SigningCredentialsToPublish".
+ -->
+ <!-- Example of publishing two signing credentials, before active use. -->
+ <!--
<util:list id="shibboleth.oidc.SigningCredentialsToPublish">
<ref bean="shibboleth.oidc.DefaultRSSigningCredential" />
<ref bean="shibboleth.oidc.DefaultESSigningCredential" />
@@ -56,4 +63,4 @@
</util:list>
-->
-</beans>
\ No newline at end of file
+</beans>
diff --git a/idp-oidc-extension-impl/src/test/resources/conf/idp-oidc.properties b/idp-oidc-extension-impl/src/test/resources/conf/oidc.properties
similarity index 100%
rename from idp-oidc-extension-impl/src/test/resources/conf/idp-oidc.properties
rename to idp-oidc-extension-impl/src/test/resources/conf/oidc.properties
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list