[java-idp-oidc] branch main updated: JOIDC-15 - Reduce manual configuration integration touchpoints with IdP
Scott Cantor
cantor.2 at osu.edu
Mon Nov 30 23:07:11 UTC 2020
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=7020c13dffe0901f3acc8238a55fe0474b2c924e
The following commit(s) were added to refs/heads/main by this push:
new 7020c13d JOIDC-15 - Reduce manual configuration integration touchpoints with IdP
7020c13d is described below
commit 7020c13dffe0901f3acc8238a55fe0474b2c924e
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Nov 30 18:07:08 2020 -0500
JOIDC-15 - Reduce manual configuration integration touchpoints with IdP
https://issues.shibboleth.net/jira/browse/JOIDC-15
Add metadata-driven profile config, WIP.
---
.../idp/service/relying-party/postconfig.xml | 211 +++++++++++++++++++--
.../src/test/resources/conf/relying-party.xml | 20 +-
2 files changed, 204 insertions(+), 27 deletions(-)
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index 85e8d666..43f8e4cc 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -13,10 +13,14 @@
<bean id="issuer" class="java.lang.String" c:_0="%{idp.oidc.issuer:%{idp.entityID}}" />
- <!-- OIDC Profile Configurations. TODO: MDDriven variants -->
- <bean id="OIDC.SSO" class="org.geant.idpextension.oidc.config.OIDCCoreProtocolConfiguration"
+ <!-- OIDC Profile Configurations. -->
+
+ <bean id="AbstractOIDCProfile" abstract="true"
+ p:securityConfiguration-ref="%{idp.security.oidc.config:shibboleth.oidc.DefaultSecurityConfiguration}" />
+
+ <bean id="OIDC.SSO" parent="AbstractOIDCProfile" lazy-init="true"
+ class="org.geant.idpextension.oidc.config.OIDCCoreProtocolConfiguration"
p:issuer-ref="issuer"
- p:securityConfiguration-ref="%{idp.security.oidc.config:shibboleth.oidc.DefaultSecurityConfiguration}"
p:iDTokenLifetime="%{idp.oidc.idToken.defaultLifetime:PT1H}"
p:accessTokenLifetime="%{idp.oidc.accessToken.defaultLifetime:PT10M}"
p:authorizeCodeLifetime="%{idp.oidc.authorizeCode.defaultLifetime:PT5M}"
@@ -24,27 +28,200 @@
p:tokenEndpointAuthMethods="%{idp.oidc.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}"
p:forcePKCE="%{idp.oidc.forcePKCE:false}"
p:allowPKCEPlain="%{idp.oidc.allowPKCEPlain:false}"/>
- <bean id="OIDC.UserInfo" class="org.geant.idpextension.oidc.config.OIDCUserInfoConfiguration"
- p:securityConfiguration-ref="%{idp.security.oidc.config:shibboleth.oidc.DefaultSecurityConfiguration}" />
- <bean id="OIDC.Registration" class="org.geant.idpextension.oidc.config.OIDCDynamicRegistrationConfiguration"
+
+ <bean id="OIDC.UserInfo" parent="AbstractOIDCProfile" lazy-init="true"
+ class="org.geant.idpextension.oidc.config.OIDCUserInfoConfiguration" />
+
+ <bean id="OIDC.Registration" parent="AbstractOIDCProfile" lazy-init="true"
+ class="org.geant.idpextension.oidc.config.OIDCDynamicRegistrationConfiguration"
p:issuer-ref="issuer"
- p:securityConfiguration-ref="%{idp.security.oidc.config:shibboleth.oidc.DefaultSecurityConfiguration}"
p:tokenEndpointAuthMethods="%{idp.oidc.dynreg.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}" />
- <bean id="OIDC.Configuration" class="org.geant.idpextension.oidc.config.OIDCProviderInformationConfiguration"
- p:issuer-ref="issuer"
- p:securityConfiguration-ref="%{idp.security.oidc.config:shibboleth.oidc.DefaultSecurityConfiguration}" />
- <bean id="OAUTH2.Revocation" class="org.geant.idpextension.oauth2.config.OAuth2TokenRevocationConfiguration"
- p:securityConfiguration-ref="%{idp.security.oidc.config:shibboleth.oidc.DefaultSecurityConfiguration}"
+
+ <bean id="OIDC.Configuration" parent="AbstractOIDCProfile" lazy-init="true"
+ class="org.geant.idpextension.oidc.config.OIDCProviderInformationConfiguration"
+ p:issuer-ref="issuer" />
+
+ <bean id="OAUTH2.Revocation" parent="AbstractOIDCProfile" lazy-init="true"
+ class="org.geant.idpextension.oauth2.config.OAuth2TokenRevocationConfiguration"
p:tokenEndpointAuthMethods="%{idp.oidc.dynreg.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}" />
- <bean id="OIDC.Keyset" class="org.geant.idpextension.oidc.config.OIDCPublishKeySetConfiguration"
+
+ <bean id="OIDC.Keyset" parent="AbstractOIDCProfile" lazy-init="true"
+ class="org.geant.idpextension.oidc.config.OIDCPublishKeySetConfiguration"
p:securityConfiguration-ref="shibboleth.oidc.PublishKeySetSecurityConfiguration" />
- <bean id="OAUTH2.Introspection" class="org.geant.idpextension.oauth2.config.OAuth2TokenIntrospectionConfiguration"
- p:securityConfiguration-ref="%{idp.security.oidc.config:shibboleth.oidc.DefaultSecurityConfiguration}"
+
+ <bean id="OAUTH2.Introspection" parent="AbstractOIDCProfile" lazy-init="true"
+ class="org.geant.idpextension.oauth2.config.OAuth2TokenIntrospectionConfiguration"
p:tokenEndpointAuthMethods="%{idp.oidc.dynreg.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}" />
+ <!-- Metadata-driven variants. -->
+
+ <bean id="AbstractMDDrivenOIDCProfile" parent="AbstractMDDrivenProfile" abstract="true">
+ <property name="securityConfigurationLookupStrategy">
+ <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="securityConfiguration"
+ p:propertyType="#{T(net.shibboleth.idp.profile.config.SecurityConfiguration)}"
+ p:defaultValue-ref="%{idp.security.oidc.config:shibboleth.oidc.DefaultSecurityConfiguration}" />
+ </property>
+ </bean>
+
+ <bean id="AbstractMDDrivenOIDCFlowAwareProfile" parent="AbstractMDDrivenOIDCProfile" abstract="true">
+ <property name="authorizationCodeFlowEnabledPredicate">
+ <bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="authorizationCodeFlowEnabled" />
+ </constructor-arg>
+ <constructor-arg value="true" />
+ </bean>
+ </property>
+ <property name="implicitFlowEnabledPredicate">
+ <bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="implicitFlowEnabled" />
+ </constructor-arg>
+ <constructor-arg value="true" />
+ </bean>
+ </property>
+ <property name="hybridFlowEnabledPredicate">
+ <bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="hybridFlowEnabled" />
+ </constructor-arg>
+ <constructor-arg value="true" />
+ </bean>
+ </property>
+ <property name="refreshTokensEnabledPredicate">
+ <bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="refreshTokensEnabled" />
+ </constructor-arg>
+ <constructor-arg value="true" />
+ </bean>
+ </property>
+ </bean>
+
+ <bean id="OIDC.SSO.MDDriven" parent="AbstractMDDrivenOIDCFlowAwareProfile" lazy-init="true"
+ class="org.geant.idpextension.oidc.config.OIDCCoreProtocolConfiguration">
+ <property name="resolveAttributesPredicate">
+ <bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="resolveAttributes" />
+ </constructor-arg>
+ <constructor-arg value="true" />
+ </bean>
+ </property>
+ <property name="forceAuthnPredicate">
+ <bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="forceAuthn" />
+ </constructor-arg>
+ <constructor-arg value="false" />
+ </bean>
+ </property>
+ <property name="forcePKCEPredicate">
+ <bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="forcePKCE" />
+ </constructor-arg>
+ <constructor-arg value="%{idp.oidc.forcePKCE:false}" />
+ </bean>
+ </property>
+ <property name="allowPKCEPlainPredicate">
+ <bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="allowPKCEPlain" />
+ </constructor-arg>
+ <constructor-arg value="%{idp.oidc.allowPKCEPlain:false}" />
+ </bean>
+ </property>
+ <property name="acrRequestAlwaysEssentialPredicate">
+ <bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="acrRequestAlwaysEssential" />
+ </constructor-arg>
+ <constructor-arg value="false" />
+ </bean>
+ </property>
+ <property name="issuerLookupStrategy">
+ <bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="issuer" p:defaultValue-ref="issuer" />
+ </property>
+ <property name="iDTokenLifetimeLookupStrategy">
+ <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="iDTokenLifetime"
+ p:defaultValue="%{idp.oidc.idToken.defaultLifetime:PT1H}" />
+ </property>
+ <property name="accessTokenLifetimeLookupStrategy">
+ <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="accessTokenLifetime"
+ p:defaultValue="%{idp.oidc.accessToken.defaultLifetime:PT10M}" />
+ </property>
+ <property name="authorizeCodeLifetimeLookupStrategy">
+ <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="authorizeCodeLifetime"
+ p:defaultValue="%{idp.oidc.authorizeCode.defaultLifetime:PT5M}" />
+ </property>
+ <property name="refreshTokenLifetimeLookupStrategy">
+ <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="refreshTokenLifetime"
+ p:defaultValue="%{idp.oidc.refreshToken.defaultLifetime:PT2H}" />
+ </property>
+ <property name="tokenEndpointAuthMethodsLookupStrategy">
+ <bean parent="shibboleth.MDDrivenListProperty" p:propertyName="tokenEndpointAuthMethods">
+ <property name="defaultValue">
+ <bean parent="shibboleth.CommaDelimStringArray">
+ <constructor-arg type="java.lang.String"
+ value="%{idp.oidc.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}" />
+ </bean>
+ </property>
+ </bean>
+ </property>
+ <property name="proxyCountLookupStrategy">
+ <bean parent="shibboleth.MDDrivenIntProperty" p:propertyName="proxyCount" />
+ </property>
+ <property name="postAuthenticationFlowsLookupStrategy">
+ <bean parent="shibboleth.MDDrivenListProperty" p:propertyName="postAuthenticationFlows" />
+ </property>
+ <property name="additionalAudiencesForIdTokenLookupStrategy">
+ <bean parent="shibboleth.MDDrivenSetProperty" p:propertyName="tokenAudiences" />
+ </property>
+ <property name="defaultAuthenticationMethodsLookupStrategy">
+ <bean parent="shibboleth.MDDrivenListProperty" p:propertyName="defaultAuthenticationMethods"
+ p:propertyType="#{T(org.geant.idpextension.oidc.authn.principal.AuthenticationContextClassReferencePrincipal)}" />
+ </property>
+ </bean>
+
+ <bean id="OIDC.UserInfo.MDDriven" parent="AbstractMDDrivenOIDCProfile" lazy-init="true"
+ class="org.geant.idpextension.oidc.config.OIDCUserInfoConfiguration" />
+
+ <bean id="OIDC.Registration.MDDriven" parent="AbstractMDDrivenOIDCFlowAwareProfile" lazy-init="true"
+ class="org.geant.idpextension.oidc.config.OIDCDynamicRegistrationConfiguration">
+ <property name="issuerLookupStrategy">
+ <bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="issuer" p:defaultValue-ref="issuer" />
+ </property>
+ <property name="tokenEndpointAuthMethodsLookupStrategy">
+ <bean parent="shibboleth.MDDrivenListProperty" p:propertyName="tokenEndpointAuthMethods">
+ <property name="defaultValue">
+ <bean parent="shibboleth.CommaDelimStringArray">
+ <constructor-arg type="java.lang.String"
+ value="%{idp.oidc.dynreg.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}" />
+ </bean>
+ </property>
+ </bean>
+ </property>
+ <property name="registrationValidityPeriodLookupStrategy">
+ <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="registrationValidityPeriod" />
+ </property>
+ <property name="secretExpirationPeriodLookupStrategy">
+ <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="secretExpirationPeriod" />
+ </property>
+ </bean>
+
+ <bean id="OIDC.Configuration.MDDriven" parent="AbstractMDDrivenOIDCProfile" lazy-init="true"
+ class="org.geant.idpextension.oidc.config.OIDCProviderInformationConfiguration">
+ <property name="issuerLookupStrategy">
+ <bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="issuer" p:defaultValue-ref="issuer" />
+ </property>
+ </bean>
+
- <!-- Security Configuration Defaults. These settings establish the default security configurations for signatures and
- loads the default credentials used. -->
+ <!--
+ Security Configuration Defaults. These settings establish the default security
+ configurations for signatures and loads the default credentials used.
+ -->
<bean id="shibboleth.oidc.DefaultSecurityConfiguration"
class="org.geant.idpextension.oidc.profile.api.OIDCSecurityConfiguration">
diff --git a/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml b/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml
index 47cb89bb..7691c02e 100644
--- a/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml
+++ b/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml
@@ -23,9 +23,9 @@
<bean id="shibboleth.UnverifiedRelyingParty" parent="RelyingParty">
<property name="profileConfigurations">
<list>
- <bean parent="OIDC.Keyset" />
- <bean parent="OIDC.Registration" />
- <bean parent="OIDC.Configuration" />
+ <ref bean="OIDC.Keyset" />
+ <ref bean="OIDC.Registration.MDDriven" />
+ <ref bean="OIDC.Configuration.MDDriven" />
</list>
</property>
</bean>
@@ -43,10 +43,10 @@
<ref bean="SAML2.Logout.MDDriven" />
<ref bean="SAML2.AttributeQuery.MDDriven" />
<ref bean="SAML2.ArtifactResolution.MDDriven" />
- <bean parent="OIDC.SSO"/>
- <bean parent="OIDC.UserInfo"/>
- <bean parent="OAUTH2.Revocation"/>
- <bean parent="OAUTH2.Introspection"/>
+ <ref bean="OIDC.SSO.MDDriven"/>
+ <ref bean="OIDC.UserInfo.MDDriven"/>
+ <ref bean="OAUTH2.Revocation"/>
+ <ref bean="OAUTH2.Introspection"/>
</list>
</property>
</bean>
@@ -55,21 +55,21 @@
<bean parent="RelyingPartyByName" c:relyingPartyIds="mockClientIdPKCEPlainUnforced">
<property name="profileConfigurations">
<list>
- <bean parent="OIDC.SSO" p:forcePKCE="false" p:allowPKCEPlain="true"/>
+ <bean parent="OIDC.SSO.MDDriven" p:forcePKCE="false" p:allowPKCEPlain="true"/>
</list>
</property>
</bean>
<bean parent="RelyingPartyByName" c:relyingPartyIds="mockClientIdPKCEPlain">
<property name="profileConfigurations">
<list>
- <bean parent="OIDC.SSO" p:forcePKCE="true" p:allowPKCEPlain="true"/>
+ <bean parent="OIDC.SSO.MDDriven" p:forcePKCE="true" p:allowPKCEPlain="true"/>
</list>
</property>
</bean>
<bean parent="RelyingPartyByName" c:relyingPartyIds="mockClientIdPKCES256">
<property name="profileConfigurations">
<list>
- <bean parent="OIDC.SSO" p:forcePKCE="true" p:allowPKCEPlain="false"/>
+ <bean parent="OIDC.SSO.MDDriven" p:forcePKCE="true" p:allowPKCEPlain="false"/>
</list>
</property>
</bean>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list