[java-idp-oidc] branch main updated: JOIDC-18 - Work out better mechanism for overriding issuer in profiles
Scott Cantor
cantor.2 at osu.edu
Tue Nov 24 20:34:54 UTC 2020
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=480f748139a8fa4abdd2bd75246318acfb709de5
The following commit(s) were added to refs/heads/main by this push:
new 480f7481 JOIDC-18 - Work out better mechanism for overriding issuer in profiles
480f7481 is described below
commit 480f748139a8fa4abdd2bd75246318acfb709de5
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Nov 24 15:34:52 2020 -0500
JOIDC-18 - Work out better mechanism for overriding issuer in profiles
https://issues.shibboleth.net/jira/browse/JOIDC-18
---
idp-oidc-extension-api/.classpath | 5 ---
.../oidc/config/OIDCCoreProtocolConfiguration.java | 30 +++++++++++++++++-
.../OIDCDynamicRegistrationConfiguration.java | 31 ++++++++++++++++++-
.../OIDCProviderInformationConfiguration.java | 36 +++++++++++++++++++++-
.../impl/FilesystemProviderMetadataResolver.java | 16 ++++++++--
.../idp/flows/oidc/discovery/discovery-beans.xml | 2 +-
.../idp/service/relying-party/postconfig.xml | 17 +++-------
.../idp/plugin/oidc/op/module.properties | 2 ++
.../oidc/op/static/openid-configuration.json | 0
.../src/test/resources/conf/relying-party.xml | 2 +-
10 files changed, 115 insertions(+), 26 deletions(-)
diff --git a/idp-oidc-extension-api/.classpath b/idp-oidc-extension-api/.classpath
index 0fb79cfe..2fcc9100 100644
--- a/idp-oidc-extension-api/.classpath
+++ b/idp-oidc-extension-api/.classpath
@@ -6,11 +6,6 @@
<attribute name="maven.pomderived" value="true"/>
</attributes>
</classpathentry>
- <classpathentry excluding="**" kind="src" output="target/classes" path="src/main/resources">
- <attributes>
- <attribute name="maven.pomderived" value="true"/>
- </attributes>
- </classpathentry>
<classpathentry kind="src" output="target/test-classes" path="src/test/java">
<attributes>
<attribute name="optional" value="true"/>
diff --git a/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/config/OIDCCoreProtocolConfiguration.java b/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/config/OIDCCoreProtocolConfiguration.java
index f436d064..b5fa192d 100644
--- a/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/config/OIDCCoreProtocolConfiguration.java
+++ b/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/config/OIDCCoreProtocolConfiguration.java
@@ -34,6 +34,7 @@ import org.opensaml.profile.context.ProfileRequestContext;
import com.google.common.base.Predicates;
import net.shibboleth.idp.authn.config.AuthenticationProfileConfiguration;
+import net.shibboleth.idp.profile.config.OverriddenIssuerProfileConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NonNegative;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
@@ -48,7 +49,7 @@ import net.shibboleth.utilities.java.support.primitive.StringSupport;
* Profile configuration for the OpenID Connect authorization and token end points.
*/
public class OIDCCoreProtocolConfiguration extends AbstractOIDCFlowAwareProfileConfiguration
- implements AuthenticationProfileConfiguration {
+ implements AuthenticationProfileConfiguration, OverriddenIssuerProfileConfiguration {
/** OIDC base protocol URI. */
@Nonnull @NotEmpty public static final String PROTOCOL_URI = "http://openid.net/specs/openid-connect-core-1_0.html";
@@ -71,6 +72,9 @@ public class OIDCCoreProtocolConfiguration extends AbstractOIDCFlowAwareProfileC
/** Whether client is allowed to use PKCE code challenge method plain. */
@Nonnull private Predicate<ProfileRequestContext> allowPKCEPlainPredicate;
+ /** Lookup function to override issuer value. */
+ @Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
+
/** Lookup function to supply proxyCount property. */
@Nonnull private Function<ProfileRequestContext,Integer> proxyCountLookupStrategy;
@@ -115,6 +119,7 @@ public class OIDCCoreProtocolConfiguration extends AbstractOIDCFlowAwareProfileC
super(profileId);
forceAuthnPredicate = Predicates.alwaysFalse();
resolveAttributesPredicate = Predicates.alwaysTrue();
+ issuerLookupStrategy = FunctionSupport.constant(null);
proxyCountLookupStrategy = FunctionSupport.constant(null);
assertionAudiencesLookupStrategy = FunctionSupport.constant(null);
@@ -132,6 +137,29 @@ public class OIDCCoreProtocolConfiguration extends AbstractOIDCFlowAwareProfileC
postAuthenticationFlowsLookupStrategy = FunctionSupport.constant(null);
}
+ /** {@inheritDoc} */
+ @Nullable @NotEmpty public String getIssuer(@Nullable final ProfileRequestContext profileRequestContext) {
+ return issuerLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Set overridden issuer value.
+ *
+ * @param issuer issuer value
+ */
+ public void setIssuer(@Nullable @NotEmpty final String issuer) {
+ issuerLookupStrategy = FunctionSupport.constant(issuer);
+ }
+
+ /**
+ * Sets lookup strategy for overridden issuer value.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setIssuerLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
+ issuerLookupStrategy = Constraint.isNotNull(strategy, "Issuer lookup strategy cannot be null");
+ }
+
/**
* Get whether attributes should be resolved during the profile.
*
diff --git a/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/config/OIDCDynamicRegistrationConfiguration.java b/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/config/OIDCDynamicRegistrationConfiguration.java
index e468df3d..42e820fb 100644
--- a/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/config/OIDCDynamicRegistrationConfiguration.java
+++ b/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/config/OIDCDynamicRegistrationConfiguration.java
@@ -24,6 +24,7 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
+import net.shibboleth.idp.profile.config.OverriddenIssuerProfileConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NonNegative;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.logic.Constraint;
@@ -32,7 +33,8 @@ import net.shibboleth.utilities.java.support.logic.FunctionSupport;
/**
* Profile configuration for the OpenID Connect dynamic client registration.
*/
-public class OIDCDynamicRegistrationConfiguration extends AbstractOIDCFlowAwareProfileConfiguration {
+public class OIDCDynamicRegistrationConfiguration extends AbstractOIDCFlowAwareProfileConfiguration
+ implements OverriddenIssuerProfileConfiguration {
/** OIDC base protocol URI. */
public static final String PROTOCOL_URI = "https://openid.net/specs/openid-connect-registration-1_0.html";
@@ -40,6 +42,9 @@ public class OIDCDynamicRegistrationConfiguration extends AbstractOIDCFlowAwareP
/** ID for this profile configuration. */
public static final String PROFILE_ID = "http://csc.fi/ns/profiles/oidc/registration";
+ /** Lookup function to override issuer value. */
+ @Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
+
/** Lookup function to supply registration validity period. */
@Nonnull private Function<ProfileRequestContext,Duration> registrationValidityPeriodLookupStrategy;
@@ -60,10 +65,34 @@ public class OIDCDynamicRegistrationConfiguration extends AbstractOIDCFlowAwareP
*/
public OIDCDynamicRegistrationConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
+ issuerLookupStrategy = FunctionSupport.constant(null);
setRegistrationValidityPeriod(Duration.ZERO);
setSecretExpirationPeriod(Duration.ZERO);
}
+ /** {@inheritDoc} */
+ @Nullable @NotEmpty public String getIssuer(@Nullable final ProfileRequestContext profileRequestContext) {
+ return issuerLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Set overridden issuer value.
+ *
+ * @param issuer issuer value
+ */
+ public void setIssuer(@Nullable @NotEmpty final String issuer) {
+ issuerLookupStrategy = FunctionSupport.constant(issuer);
+ }
+
+ /**
+ * Sets lookup strategy for overridden issuer value.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setIssuerLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
+ issuerLookupStrategy = Constraint.isNotNull(strategy, "Issuer lookup strategy cannot be null");
+ }
+
/**
* Get dynamic registration validity period.
*
diff --git a/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/config/OIDCProviderInformationConfiguration.java b/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/config/OIDCProviderInformationConfiguration.java
index d4ebaeb9..6542132d 100644
--- a/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/config/OIDCProviderInformationConfiguration.java
+++ b/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/config/OIDCProviderInformationConfiguration.java
@@ -16,18 +16,25 @@
package org.geant.idpextension.oidc.config;
+import java.util.function.Function;
+
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import org.geant.idpextension.oidc.profile.config.OIDCProfileConfiguration;
+import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.idp.profile.config.AbstractConditionalProfileConfiguration;
+import net.shibboleth.idp.profile.config.OverriddenIssuerProfileConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.logic.FunctionSupport;
/**
* Profile configuration for the OpenID Connect Provider Configuration.
*/
public class OIDCProviderInformationConfiguration extends AbstractConditionalProfileConfiguration
- implements OIDCProfileConfiguration {
+ implements OIDCProfileConfiguration, OverriddenIssuerProfileConfiguration {
/** OIDC base protocol URI. Section 4 is relevant. */
public static final String PROTOCOL_URI = "http://openid.net/specs/openid-connect-discovery-1_0.html";
@@ -35,6 +42,9 @@ public class OIDCProviderInformationConfiguration extends AbstractConditionalPro
/** ID for this profile configuration. */
public static final String PROFILE_ID = "http://csc.fi/ns/profiles/oidc/configuration";
+ /** Lookup function to override issuer value. */
+ @Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
+
/**
* Constructor.
*/
@@ -49,6 +59,30 @@ public class OIDCProviderInformationConfiguration extends AbstractConditionalPro
*/
public OIDCProviderInformationConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
+ issuerLookupStrategy = FunctionSupport.constant(null);
+ }
+
+ /** {@inheritDoc} */
+ @Nullable @NotEmpty public String getIssuer(@Nullable final ProfileRequestContext profileRequestContext) {
+ return issuerLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Set overridden issuer value.
+ *
+ * @param issuer issuer value
+ */
+ public void setIssuer(@Nullable @NotEmpty final String issuer) {
+ issuerLookupStrategy = FunctionSupport.constant(issuer);
}
+ /**
+ * Sets lookup strategy for overridden issuer value.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setIssuerLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
+ issuerLookupStrategy = Constraint.isNotNull(strategy, "Issuer lookup strategy cannot be null");
+ }
+
}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/metadata/impl/FilesystemProviderMetadataResolver.java b/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/metadata/impl/FilesystemProviderMetadataResolver.java
index fc351dde..d6280de7 100644
--- a/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/metadata/impl/FilesystemProviderMetadataResolver.java
+++ b/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/metadata/impl/FilesystemProviderMetadataResolver.java
@@ -39,6 +39,7 @@ import com.nimbusds.oauth2.sdk.id.Issuer;
import com.nimbusds.oauth2.sdk.util.JSONObjectUtils;
import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
+import net.shibboleth.idp.profile.config.OverriddenIssuerProfileConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
@@ -113,11 +114,20 @@ public class FilesystemProviderMetadataResolver extends AbstractFileOIDCEntityRe
return entities;
}
- final String responderId = rpCtx.getConfiguration().getResponderId(profileRequestContext);
-
+ String responderId = null;
+ if (rpCtx.getProfileConfig() instanceof OverriddenIssuerProfileConfiguration) {
+ responderId =
+ ((OverriddenIssuerProfileConfiguration) rpCtx.getProfileConfig()).getIssuer(profileRequestContext);
+ }
+
+ if (responderId == null) {
+ responderId = rpCtx.getConfiguration().getResponderId(profileRequestContext);
+ }
+
+ final String issuer = responderId;
return entities
.stream()
- .filter(e -> e.getIssuer().getValue().equals(responderId))
+ .filter(e -> e.getIssuer().getValue().equals(issuer))
.collect(Collectors.toUnmodifiableList());
}
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/discovery/discovery-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/discovery/discovery-beans.xml
index b2b3b257..54670e21 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/discovery/discovery-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/discovery/discovery-beans.xml
@@ -41,7 +41,7 @@
</bean>
<bean id="MetadataSkeleton" class="org.springframework.core.io.FileSystemResource"
- c:path="%{idp.oidc.discovery.template:/opt/shibboleth-idp/static/.well-known/openid-configuration}" />
+ c:path="%{idp.oidc.discovery.template:%{idp.home}/static/openid-configuration.json}" />
<bean id="CredentialResolver" class="org.geant.idpextension.oidc.metadata.impl.CredentialMetadataValueResolver" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index 3b5a2a33..85e8d666 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -11,22 +11,11 @@
default-init-method="initialize" default-destroy-method="destroy">
- <bean id="issuer" class="java.lang.String" c:_0="%{idp.oidc.issuer}" />
+ <bean id="issuer" class="java.lang.String" c:_0="%{idp.oidc.issuer:%{idp.entityID}}" />
- <!-- Configure profiles that need to use issuer instead of entity id as responder id. -->
- <util:map id="profileResponders">
- <entry key-ref="OIDC.SSO" value-ref="issuer" />
- <entry key-ref="OIDC.Registration" value-ref="issuer" />
- <entry key-ref="OIDC.Configuration" value-ref="issuer" />
- </util:map>
-
- <!-- Lookup method to select responder id -->
- <bean id="profileResponderIdLookupFunction"
- class="org.geant.idpextension.oidc.profile.context.navigate.ProfileResponderIdLookupFunction"
- p:defaultResponder-ref="entityID" p:profileResponders-ref="profileResponders" />
-
<!-- OIDC Profile Configurations. TODO: MDDriven variants -->
<bean id="OIDC.SSO" class="org.geant.idpextension.oidc.config.OIDCCoreProtocolConfiguration"
+ p:issuer-ref="issuer"
p:securityConfiguration-ref="%{idp.security.oidc.config:shibboleth.oidc.DefaultSecurityConfiguration}"
p:iDTokenLifetime="%{idp.oidc.idToken.defaultLifetime:PT1H}"
p:accessTokenLifetime="%{idp.oidc.accessToken.defaultLifetime:PT10M}"
@@ -38,9 +27,11 @@
<bean id="OIDC.UserInfo" class="org.geant.idpextension.oidc.config.OIDCUserInfoConfiguration"
p:securityConfiguration-ref="%{idp.security.oidc.config:shibboleth.oidc.DefaultSecurityConfiguration}" />
<bean id="OIDC.Registration" class="org.geant.idpextension.oidc.config.OIDCDynamicRegistrationConfiguration"
+ p:issuer-ref="issuer"
p:securityConfiguration-ref="%{idp.security.oidc.config:shibboleth.oidc.DefaultSecurityConfiguration}"
p:tokenEndpointAuthMethods="%{idp.oidc.dynreg.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}" />
<bean id="OIDC.Configuration" class="org.geant.idpextension.oidc.config.OIDCProviderInformationConfiguration"
+ p:issuer-ref="issuer"
p:securityConfiguration-ref="%{idp.security.oidc.config:shibboleth.oidc.DefaultSecurityConfiguration}" />
<bean id="OAUTH2.Revocation" class="org.geant.idpextension.oauth2.config.OAuth2TokenRevocationConfiguration"
p:securityConfiguration-ref="%{idp.security.oidc.config:shibboleth.oidc.DefaultSecurityConfiguration}"
diff --git a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/module.properties b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/module.properties
index a3bd7628..098122e1 100644
--- a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/module.properties
+++ b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/module.properties
@@ -17,5 +17,7 @@ idp.oidc.OP.3.src = /net/shibboleth/idp/plugin/oidc/op/conf/oidc-credentials.xml
idp.oidc.OP.3.dest = conf/oidc-credentials.xml
idp.oidc.OP.4.src = /net/shibboleth/idp/plugin/oidc/op/conf/oidc-attribute-filter.xml
idp.oidc.OP.4.dest = conf/oidc-attribute-filter.xml
+idp.oidc.OP.5.src = /net/shibboleth/idp/plugin/oidc/op/static/openid-configuration.json
+idp.oidc.OP.5.dest = static/openid-configuration.json
idp.oidc.OP.postenable = See documentation for additional instructions to enable the OP module.
\ No newline at end of file
diff --git a/idp-oidc-extension-distribution/src/main/resources/static/.well-known/openid-configuration b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/static/openid-configuration.json
similarity index 100%
rename from idp-oidc-extension-distribution/src/main/resources/static/.well-known/openid-configuration
rename to idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/static/openid-configuration.json
diff --git a/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml b/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml
index 5c1f2e5b..47cb89bb 100644
--- a/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml
+++ b/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml
@@ -20,7 +20,7 @@
legitimacy of a requesting system. To run an "open" IdP, you can enable profiles here.
-->
- <bean id="shibboleth.UnverifiedRelyingParty" p:responderIdLookupStrategy-ref="profileResponderIdLookupFunction" parent="RelyingParty">
+ <bean id="shibboleth.UnverifiedRelyingParty" parent="RelyingParty">
<property name="profileConfigurations">
<list>
<bean parent="OIDC.Keyset" />
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list