[java-idp-oidc] 07/44: JOIDC-5 Adapt to the refactored schema
Henri Mikkonen
henri.mikkonen at iki.fi
Thu Oct 22 13:08:19 UTC 2020
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=a3d9c46f30aee1e769a356af04a3efba8d968b40
commit a3d9c46f30aee1e769a356af04a3efba8d968b40
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Apr 17 15:05:38 2020 +0300
JOIDC-5 Adapt to the refactored schema
https://issues.shibboleth.net/jira/browse/JOIDC-5
---
.../impl/ClientInformationNodeProcessor.java | 331 ++++++++++++---------
.../profile/impl/PopulateOIDCMetadataContext.java | 8 +-
.../idp/flows/oidc/authorize/authorize-beans.xml | 9 +-
.../impl/ClientInformationNodeProcessorTest.java | 25 +-
4 files changed, 210 insertions(+), 163 deletions(-)
diff --git a/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/metadata/impl/ClientInformationNodeProcessor.java b/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/metadata/impl/ClientInformationNodeProcessor.java
index 1816ab02..1db5ff1e 100644
--- a/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/metadata/impl/ClientInformationNodeProcessor.java
+++ b/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/metadata/impl/ClientInformationNodeProcessor.java
@@ -18,24 +18,32 @@ package org.geant.idpextension.oidc.metadata.impl;
import java.net.URI;
import java.net.URISyntaxException;
-import java.security.interfaces.ECPublicKey;
-import java.security.interfaces.RSAPublicKey;
import java.util.ArrayList;
import java.util.HashSet;
import java.util.List;
import java.util.Set;
+import javax.xml.namespace.QName;
+
+import org.geant.idpextension.keyinfo.ext.impl.provider.ClientSecretProvider;
+import org.geant.idpextension.keyinfo.ext.impl.provider.InlineJwksProvider;
+import org.geant.idpextension.keyinfo.ext.impl.provider.JWKSReferenceProvider;
+import org.geant.idpextension.oidc.config.OIDCCoreProtocolConfiguration;
import org.geant.idpextension.oidc.security.impl.CredentialConversionUtil;
+import org.geant.security.jwk.NimbusSecretCredential;
import org.opensaml.core.xml.XMLObject;
import org.opensaml.saml.criterion.RoleDescriptorCriterion;
import org.opensaml.saml.metadata.resolver.RoleDescriptorResolver;
import org.opensaml.saml.metadata.resolver.filter.FilterException;
import org.opensaml.saml.metadata.resolver.filter.MetadataNodeProcessor;
+import org.opensaml.saml.saml2.metadata.AssertionConsumerService;
import org.opensaml.saml.saml2.metadata.EntityDescriptor;
+import org.opensaml.saml.saml2.metadata.Extensions;
+import org.opensaml.saml.saml2.metadata.NameIDFormat;
import org.opensaml.saml.saml2.metadata.RoleDescriptor;
+import org.opensaml.saml.saml2.metadata.SPSSODescriptor;
import org.opensaml.saml.security.impl.MetadataCredentialResolver;
import org.opensaml.security.credential.Credential;
-import org.opensaml.security.credential.UsageType;
import org.opensaml.xmlsec.keyinfo.KeyInfoCredentialResolver;
import org.opensaml.xmlsec.keyinfo.impl.BasicProviderKeyInfoCredentialResolver;
import org.opensaml.xmlsec.keyinfo.impl.KeyInfoProvider;
@@ -48,15 +56,13 @@ import org.slf4j.LoggerFactory;
import com.nimbusds.jose.EncryptionMethod;
import com.nimbusds.jose.JWEAlgorithm;
import com.nimbusds.jose.JWSAlgorithm;
-import com.nimbusds.jose.jwk.Curve;
-import com.nimbusds.jose.jwk.ECKey;
import com.nimbusds.jose.jwk.JWK;
-import com.nimbusds.jose.jwk.KeyUse;
-import com.nimbusds.jose.jwk.RSAKey;
+import com.nimbusds.jose.jwk.JWKSet;
import com.nimbusds.oauth2.sdk.GrantType;
import com.nimbusds.oauth2.sdk.ResponseType;
import com.nimbusds.oauth2.sdk.Scope;
import com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod;
+import com.nimbusds.oauth2.sdk.auth.Secret;
import com.nimbusds.oauth2.sdk.id.ClientID;
import com.nimbusds.oauth2.sdk.id.SoftwareID;
import com.nimbusds.oauth2.sdk.id.SoftwareVersion;
@@ -68,7 +74,7 @@ import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
import net.shibboleth.idp.saml.oidc.xmlobject.DefaultAcrValue;
import net.shibboleth.idp.saml.oidc.xmlobject.MetadataValueSAMLObject;
-import net.shibboleth.idp.saml.oidc.xmlobject.OAuthRPRoleDescriptorType;
+import net.shibboleth.idp.saml.oidc.xmlobject.OAuthRPExtensions;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
@@ -76,7 +82,8 @@ import net.shibboleth.utilities.java.support.resolver.ResolverException;
/**
* An implementation of {@link MetadataNodeProcessor} which supports adding an instance of
- * {@link OIDCClientInformation} to the object metadata of {@link OAuthRPRoleDescriptorType}.
+ * {@link OIDCClientInformation} to the object metadata of {@link SPSSODescriptor}. The data
+ * is fetched mainly via {@link OAuthRPExtensions}.
*/
public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
@@ -90,11 +97,124 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
keyInfoProviders.add(new DSAKeyValueProvider());
keyInfoProviders.add(new RSAKeyValueProvider());
keyInfoProviders.add(new InlineX509DataProvider());
+ keyInfoProviders.add(new InlineJwksProvider());
+ keyInfoProviders.add(new JWKSReferenceProvider());
+ keyInfoProviders.add(new ClientSecretProvider());
+
keyInfoCredentialResolver = new BasicProviderKeyInfoCredentialResolver(keyInfoProviders);
}
- protected Iterable<Credential> resolveCredentials(final OAuthRPRoleDescriptorType roleDescriptor) {
+ @Override
+ public void process(XMLObject metadataNode) throws FilterException {
+ if (metadataNode instanceof SPSSODescriptor) {
+ final SPSSODescriptor roleDescriptor = (SPSSODescriptor) metadataNode;
+ if (roleDescriptor.isSupportedProtocol(OIDCCoreProtocolConfiguration.PROTOCOL_URI)) {
+ final ClientID clientId = parseClientID(roleDescriptor);
+ if (clientId == null || StringSupport.trimOrNull(clientId.getValue()) == null) {
+ log.error("Could not find a value for client_id, nothing to do");
+ return;
+ }
+ final Iterable<Credential> credentials = resolveCredentials(roleDescriptor);
+ final OIDCClientMetadata metadata = populateMetadata(roleDescriptor, credentials, clientId.getValue());
+ final Secret clientSecret = parseClientSecret(credentials);
+ final OIDCClientInformation clientInformation = new OIDCClientInformation(clientId, null, metadata, clientSecret);
+ metadataNode.getObjectMetadata().put(clientInformation);
+ }
+ } else {
+ log.trace("Ignoring object {}", metadataNode);
+ }
+ }
+
+
+ protected ClientID parseClientID(final SPSSODescriptor roleDescriptor) {
+ if (!roleDescriptor.hasParent() || !(roleDescriptor.getParent() instanceof EntityDescriptor)) {
+ log.warn("Unexpected structure, EntityDescriptor not as a parent for OAuthRPRoleDescriptor");
+ return null;
+ }
+ final EntityDescriptor entityDescriptor = (EntityDescriptor) roleDescriptor.getParent();
+ return new ClientID(entityDescriptor.getEntityID());
+ }
+
+ protected Secret parseClientSecret(final Iterable<Credential> credentials) {
+ for (final Credential credential : credentials) {
+ log.trace("Processing credential type {}", credential.getCredentialType());
+ if (NimbusSecretCredential.class.isAssignableFrom(credential.getCredentialType())) {
+ log.debug("Found client secret from the credentials");
+ return ((NimbusSecretCredential) credential).getSecret();
+ }
+ }
+ log.trace("No client secret found from the credentials");
+ return null;
+ }
+
+ protected OIDCClientMetadata populateMetadata(final SPSSODescriptor roleDescriptor, final Iterable<Credential> credentials, final String clientId) {
+ final OIDCClientMetadata metadata = new OIDCClientMetadata();
+ final OAuthRPExtensions extensions = getOAuthRPExtensions(roleDescriptor);
+ if (extensions != null) {
+ metadata.setApplicationType(parseApplicationType(extensions));
+ metadata.setURI(getSingleURIValue(extensions.getClientUri()));
+ metadata.setDefaultACRs(parseDefaultAcrValues(extensions));
+ metadata.setGrantTypes(parseGrantTypes(extensions));
+ metadata.setIDTokenJWEAlg(parseJweAlgorithm(extensions.getIdTokenEncryptionResponseAlg()));
+ metadata.setIDTokenJWEEnc(parseEncryptionMethod(extensions.getIdTokenEncryptionResponseEnc()));
+ metadata.setIDTokenJWSAlg(parseJwsAlgorithm(extensions.getIdTokenSignedResponseAlg()));
+ metadata.setInitiateLoginURI(getSingleURIValue(extensions.getInitiateLoginUri()));
+ metadata.setJWKSetURI(getSingleURIValue(extensions.getJwksUri()));
+ metadata.setPostLogoutRedirectionURIs(parseUris(extensions.getPostLogoutRedirectUris()));
+ metadata.setRedirectionURIs(parseRedirectUris(roleDescriptor));
+ metadata.setRequestObjectJWEAlg(parseJweAlgorithm(extensions.getRequestObjectEncryptionResponseAlg()));
+ metadata.setRequestObjectJWEEnc(parseEncryptionMethod(extensions.getRequestObjectEncryptionResponseEnc()));
+ metadata.setRequestObjectJWSAlg(parseJwsAlgorithm(extensions.getRequestObjectSignedResponseAlg()));
+ metadata.setRequestObjectURIs(parseUris(extensions.getRequestUris()));
+ metadata.setResponseTypes(parseResponseTypes(extensions));
+ metadata.setScope(parseScope(extensions));
+ metadata.setSectorIDURI(getSingleURIValue(extensions.getSectorIdentifierUri()));
+ final String softwareId = getSingleValue(extensions.getSoftwareId());
+ if (softwareId != null) {
+ metadata.setSoftwareID(new SoftwareID(softwareId));
+ }
+ final String softwareVersion = getSingleValue(extensions.getSoftwareVersion());
+ if (softwareVersion != null) {
+ metadata.setSoftwareVersion(new SoftwareVersion(softwareVersion));
+ }
+ metadata.setSubjectType(parseSubjectType(roleDescriptor));
+ metadata.setTokenEndpointAuthMethod(parseClientAuthenticationMethod(extensions));
+ metadata.setTokenEndpointAuthJWSAlg(parseJwsAlgorithm(extensions.getTokenEndpointAuthSigningAlg()));
+ metadata.setUserInfoJWEAlg(parseJweAlgorithm(extensions.getUserInfoEncryptionResponseAlg()));
+ metadata.setUserInfoJWEEnc(parseEncryptionMethod(extensions.getUserInfoEncryptionResponseEnc()));
+ metadata.setUserInfoJWSAlg(parseJwsAlgorithm(extensions.getUserInfoSignedResponseAlg()));
+ metadata.setJWKSet(parseJwkSet(credentials, clientId));
+
+ } else {
+ log.debug("No OAuthRPExtensions found to be processed");
+ }
+ return metadata;
+ }
+
+ protected OAuthRPExtensions getOAuthRPExtensions(final SPSSODescriptor roleDescriptor) {
+ final Extensions extensions = roleDescriptor.getExtensions();
+ if (extensions == null) {
+ log.debug("No extensions found from the given SPSSODescriptor");
+ return null;
+ }
+ final List<XMLObject> rpExtensions = extensions.getUnknownXMLObjects();
+ if (rpExtensions == null || rpExtensions.isEmpty()) {
+ log.debug("The extension element on SPSSODescriptor didn't have any child elements");
+ return null;
+ }
+ if (rpExtensions.size() > 1) {
+ log.warn("More than one OAuthRPExtensions defined, using only one of them");
+ }
+ if (rpExtensions.get(0) instanceof OAuthRPExtensions) {
+ log.debug("Successfully parsed OAuthRPExtensions");
+ return (OAuthRPExtensions) rpExtensions.get(0);
+ }
+ log.warn("Could not parse OAuthRPExtensions from the element");
+ return null;
+ }
+
+ protected Iterable<Credential> resolveCredentials(final SPSSODescriptor roleDescriptor) {
final MetadataCredentialResolver credentialResolver = new MetadataCredentialResolver();
credentialResolver.setKeyInfoCredentialResolver(keyInfoCredentialResolver);
credentialResolver.setRoleDescriptorResolver(new RoleDescriptorResolver() {
@@ -113,7 +233,7 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
@Override
public String getId() {
- return null;
+ return "EmbeddedLocalRoleDescriptorResolver";
}
@Override
@@ -127,160 +247,83 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
}
});
+
+ final RoleDescriptorCriterion criterion = new RoleDescriptorCriterion(roleDescriptor);
+ final CriteriaSet criteriaSet = new CriteriaSet();
+ criteriaSet.add(criterion);
try {
credentialResolver.initialize();
} catch (ComponentInitializationException e) {
- log.error("Could not initialize the metdadata credential resolver", e);
- return null;
+ log.error("Could not initialize the SAML metadata credential resolver, cannot resolve JWKSet", e);
}
- final CriteriaSet criteriaSet = new CriteriaSet();
- criteriaSet.add(new RoleDescriptorCriterion(roleDescriptor));
-
try {
return credentialResolver.resolve(criteriaSet);
} catch (ResolverException e) {
- log.error("Could not resolve credentials", e);
- return null;
- }
- }
-
- @Override
- public void process(XMLObject metadataNode) throws FilterException {
- if (metadataNode instanceof OAuthRPRoleDescriptorType) {
- final OAuthRPRoleDescriptorType roleDescriptor = (OAuthRPRoleDescriptorType) metadataNode;
- log.info("Keys: {}", roleDescriptor.getKeyDescriptors());
- final ClientID clientId = parseClientID(roleDescriptor);
- if (clientId == null) {
- log.error("Could not find a value for client_id, nothing to do");
- return;
- }
- final OIDCClientMetadata metadata = populateMetadata(roleDescriptor);
- final OIDCClientInformation clientInformation = new OIDCClientInformation(clientId, null, metadata, null);
- metadataNode.getObjectMetadata().put(clientInformation);
-
- final Iterable<Credential> credentials = resolveCredentials(roleDescriptor);
- if (credentials != null) {
- for (final Credential credential : credentials) {
- log.debug("JWK {}", credentialToKey(credential).toJSONString());
- }
- }
- }
-
- }
-
- /**
- * Resolved KeyUse parameter from credential.
- *
- * @param credential credential to resolve KeyUse of
- * @return KeyUse of credential
- */
- private KeyUse resolveKeyUse(Credential credential) {
- if (credential.getUsageType().equals(UsageType.SIGNING)) {
- return KeyUse.SIGNATURE;
- }
- if (credential.getUsageType().equals(UsageType.ENCRYPTION)) {
- return KeyUse.ENCRYPTION;
+ log.warn("Could not resolve credentials", e);
}
return null;
}
-
- /**
- * Convert credential to JWK. Only RSA and EC keys supported.
- *
- * @param credential to convert.
- * @return credential as JWK.
- */
- private JWK credentialToKey(Credential credential) {
- JWK key = null;
- switch (credential.getPublicKey().getAlgorithm()) {
- case "RSA":
- key = new RSAKey.Builder((RSAPublicKey) credential.getPublicKey()).keyUse(resolveKeyUse(credential))
- .keyID(CredentialConversionUtil.resolveKid(credential)).build();
- break;
-
- case "EC":
- key = new ECKey.Builder(Curve.forECParameterSpec(((ECPublicKey) credential.getPublicKey()).getParams()),
- (ECPublicKey) credential.getPublicKey()).keyUse(resolveKeyUse(credential))
- .keyID(CredentialConversionUtil.resolveKid(credential)).build();
- default:
- break;
- }
- return key;
- }
- protected ClientID parseClientID(final OAuthRPRoleDescriptorType roleDescriptor) {
- if (!roleDescriptor.hasParent() || !(roleDescriptor.getParent() instanceof EntityDescriptor)) {
- log.warn("Unexpected structure, EntityDescriptor not as a parent for OAuthRPRoleDescriptor");
- return null;
+ protected JWKSet parseJwkSet(final Iterable<Credential> credentials, final String clientId) {
+ final List<JWK> jwks = new ArrayList<>();
+ for (final Credential credential : credentials) {
+ final JWK jwk = CredentialConversionUtil.credentialToKey(credential);
+ if (jwk == null) {
+ log.debug("Could not parse credential of {} to a JWK", clientId);
+ } else {
+ log.trace("Successfully parsed a JWK to client {}: {}", clientId, jwk.toJSONString());
+ jwks.add(jwk);
+ }
}
- final EntityDescriptor entityDescriptor = (EntityDescriptor) roleDescriptor.getParent();
- return new ClientID(entityDescriptor.getEntityID());
+ return jwks.isEmpty() ? null : new JWKSet(jwks);
}
- protected OIDCClientMetadata populateMetadata(final OAuthRPRoleDescriptorType roleDescriptor) {
- final OIDCClientMetadata metadata = new OIDCClientMetadata();
- metadata.setApplicationType(parseApplicationType(roleDescriptor));
- metadata.setURI(getSingleURIValue(roleDescriptor.getClientUri()));
- metadata.setDefaultACRs(parseDefaultAcrValues(roleDescriptor));
- metadata.setGrantTypes(parseGrantTypes(roleDescriptor));
- metadata.setIDTokenJWEAlg(parseJweAlgorithm(roleDescriptor.getIdTokenEncryptionResponseAlg()));
- metadata.setIDTokenJWEEnc(parseEncryptionMethod(roleDescriptor.getIdTokenEncryptionResponseEnc()));
- metadata.setIDTokenJWSAlg(parseJwsAlgorithm(roleDescriptor.getIdTokenSignedResponseAlg()));
- metadata.setInitiateLoginURI(getSingleURIValue(roleDescriptor.getInitiateLoginUri()));
- metadata.setJWKSetURI(getSingleURIValue(roleDescriptor.getJwksUri()));
- metadata.setPostLogoutRedirectionURIs(parseUris(roleDescriptor.getPostLogoutRedirectUris()));
- metadata.setRedirectionURIs(parseUris(roleDescriptor.getRedirectUris()));
- metadata.setRequestObjectJWEAlg(parseJweAlgorithm(roleDescriptor.getRequestObjectEncryptionResponseAlg()));
- metadata.setRequestObjectJWEEnc(parseEncryptionMethod(roleDescriptor.getRequestObjectEncryptionResponseEnc()));
- metadata.setRequestObjectJWSAlg(parseJwsAlgorithm(roleDescriptor.getRequestObjectSignedResponseAlg()));
- metadata.setRequestObjectURIs(parseUris(roleDescriptor.getRequestUris()));
- metadata.setResponseTypes(parseResponseTypes(roleDescriptor));
- metadata.setScope(parseScope(roleDescriptor));
- metadata.setSectorIDURI(getSingleURIValue(roleDescriptor.getSectorIdentifierUri()));
- final String softwareId = getSingleValue(roleDescriptor.getSoftwareId());
- if (softwareId != null) {
- metadata.setSoftwareID(new SoftwareID(softwareId));
- }
- final String softwareVersion = getSingleValue(roleDescriptor.getSoftwareVersion());
- if (softwareVersion != null) {
- metadata.setSoftwareVersion(new SoftwareVersion(softwareVersion));
+ protected List<MetadataValueSAMLObject> getFromExtensions(final Extensions extension, final QName type) {
+ final List<XMLObject> list = extension.getUnknownXMLObjects(type);
+ final List<MetadataValueSAMLObject> result = new ArrayList<>();
+ for (final XMLObject object : list) {
+ if (object instanceof MetadataValueSAMLObject) {
+ result.add((MetadataValueSAMLObject) object);
+ }
}
- metadata.setSubjectType(parseSubjectType(roleDescriptor));
- metadata.setTokenEndpointAuthMethod(parseClientAuthenticationMethod(roleDescriptor));
- metadata.setTokenEndpointAuthJWSAlg(parseJwsAlgorithm(roleDescriptor.getTokenEndpointAuthSigningAlg()));
- metadata.setUserInfoJWEAlg(parseJweAlgorithm(roleDescriptor.getUserInfoEncryptionResponseAlg()));
- metadata.setUserInfoJWEEnc(parseEncryptionMethod(roleDescriptor.getUserInfoEncryptionResponseEnc()));
- metadata.setUserInfoJWSAlg(parseJwsAlgorithm(roleDescriptor.getUserInfoSignedResponseAlg()));
- return metadata;
+ return result;
}
- protected ClientAuthenticationMethod parseClientAuthenticationMethod(final OAuthRPRoleDescriptorType roleDescriptor) {
- final String metadataValue = getSingleValue(roleDescriptor.getTokenEndpointAuthMethod());
+ protected ClientAuthenticationMethod parseClientAuthenticationMethod(final OAuthRPExtensions extensions) {
+ final String metadataValue = getSingleValue(extensions.getTokenEndpointAuthMethod());
if (metadataValue == null) {
return null;
}
return ClientAuthenticationMethod.parse(metadataValue);
}
- protected ApplicationType parseApplicationType(final OAuthRPRoleDescriptorType roleDescriptor) {
- final String metadataValue = getSingleValue(roleDescriptor.getApplicationType());
+ protected ApplicationType parseApplicationType(final OAuthRPExtensions extensions) {
+ final String metadataValue = getSingleValue(extensions.getApplicationType());
if (ApplicationType.NATIVE.toString().equalsIgnoreCase(metadataValue)) {
return ApplicationType.NATIVE;
}
return ApplicationType.WEB;
}
- protected SubjectType parseSubjectType(final OAuthRPRoleDescriptorType roleDescriptor) {
- final String metadataValue = getSingleValue(roleDescriptor.getSubjectType());
+ protected SubjectType parseSubjectType(final SPSSODescriptor roleDescriptor) {
+ final List<NameIDFormat> nameIdFormats = roleDescriptor.getNameIDFormats();
+ if (nameIdFormats == null || nameIdFormats.isEmpty()) {
+ log.warn("No NameIDFormat defined, using public");
+ return SubjectType.PUBLIC;
+ }
+ if (nameIdFormats.size() > 1) {
+ log.warn("Multiple NameIDFormats defined, using first one");
+ }
+ final String metadataValue = nameIdFormats.get(0).getURI();
if (SubjectType.PAIRWISE.toString().equalsIgnoreCase(metadataValue)) {
return SubjectType.PAIRWISE;
}
return SubjectType.PUBLIC;
}
- protected List<ACR> parseDefaultAcrValues(final OAuthRPRoleDescriptorType roleDescriptor) {
+ protected List<ACR> parseDefaultAcrValues(final OAuthRPExtensions extensions) {
final List<ACR> acrs = new ArrayList<>();
- for (final DefaultAcrValue acr : roleDescriptor.getDefaultAcrValues()) {
+ for (final DefaultAcrValue acr : extensions.getDefaultAcrValues()) {
final String value = getSingleValue(acr);
if (value != null) {
acrs.add(new ACR(value));
@@ -289,9 +332,9 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
return acrs;
}
- protected Set<GrantType> parseGrantTypes(final OAuthRPRoleDescriptorType roleDescriptor) {
+ protected Set<GrantType> parseGrantTypes(final OAuthRPExtensions extensions) {
final Set<GrantType> grantTypes = new HashSet<>();
- for (final net.shibboleth.idp.saml.oidc.xmlobject.GrantType grantType : roleDescriptor.getGrantTypes()) {
+ for (final net.shibboleth.idp.saml.oidc.xmlobject.GrantType grantType : extensions.getGrantTypes()) {
final String value = getSingleValue(grantType);
if (value != null) {
grantTypes.add(new GrantType(value));
@@ -300,9 +343,9 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
return grantTypes;
}
- protected Set<ResponseType> parseResponseTypes(final OAuthRPRoleDescriptorType roleDescriptor) {
+ protected Set<ResponseType> parseResponseTypes(final OAuthRPExtensions extensions) {
final Set<ResponseType> responseTypes = new HashSet<>();
- for (final net.shibboleth.idp.saml.oidc.xmlobject.ResponseType responseType : roleDescriptor.getResponseTypes()) {
+ for (final net.shibboleth.idp.saml.oidc.xmlobject.ResponseType responseType : extensions.getResponseTypes()) {
final String value = getSingleValue(responseType);
if (value != null) {
responseTypes.add(new ResponseType(value));
@@ -311,9 +354,9 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
return responseTypes;
}
- protected Scope parseScope(final OAuthRPRoleDescriptorType roleDescriptor) {
+ protected Scope parseScope(final OAuthRPExtensions extensions) {
final Scope scope = new Scope();
- for (final net.shibboleth.idp.saml.oidc.xmlobject.Scope singleScope : roleDescriptor.getScopes()) {
+ for (final net.shibboleth.idp.saml.oidc.xmlobject.Scope singleScope : extensions.getScopes()) {
final String value = getSingleValue(singleScope);
if (value != null) {
scope.add(value);
@@ -349,6 +392,19 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
return null;
}
+ protected Set<URI> parseRedirectUris(final SPSSODescriptor roleDescriptor) {
+ final Set<URI> uris = new HashSet<>();
+ for (final AssertionConsumerService acs : roleDescriptor.getAssertionConsumerServices()) {
+ if (OIDCCoreProtocolConfiguration.PROFILE_ID.equals(acs.getBinding())) {
+ final URI uri = getSingleURIValue(acs.getLocation());
+ if (uri != null) {
+ uris.add(uri);
+ }
+ }
+ }
+ return uris;
+ }
+
protected Set<URI> parseUris(final List<? extends MetadataValueSAMLObject> listOfValues) {
final Set<URI> uris = new HashSet<>();
for (final MetadataValueSAMLObject value : listOfValues) {
@@ -368,7 +424,10 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
}
protected URI getSingleURIValue(final MetadataValueSAMLObject metadataValue) {
- final String value = getSingleValue(metadataValue);
+ return getSingleURIValue(getSingleValue(metadataValue));
+ }
+
+ protected URI getSingleURIValue(final String value) {
if (value != null) {
try {
return new URI(value);
diff --git a/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/profile/impl/PopulateOIDCMetadataContext.java b/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/profile/impl/PopulateOIDCMetadataContext.java
index 1ce0fd46..8843265e 100644
--- a/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/profile/impl/PopulateOIDCMetadataContext.java
+++ b/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/profile/impl/PopulateOIDCMetadataContext.java
@@ -29,20 +29,20 @@ import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.saml.common.messaging.context.SAMLMetadataContext;
import org.opensaml.saml.saml2.metadata.RoleDescriptor;
+import org.opensaml.saml.saml2.metadata.SPSSODescriptor;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
import net.shibboleth.idp.profile.AbstractProfileAction;
-import net.shibboleth.idp.saml.oidc.xmlobject.OAuthRPRoleDescriptorType;
import net.shibboleth.idp.saml.profile.context.navigate.SAMLMetadataContextLookupFunction;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
/**
* An action that attempts to locate OIDC client information from the SAML entity descriptor containing role
- * descriptor of type {@link OAuthRPRoleDescriptorType}. If it contains {@link OIDCClientInformation} in the
+ * descriptor of type {@link SPSSODescriptor}. If it contains {@link OIDCClientInformation} in the
* object metadata, it is attached inside {@link OIDCMetadataContext} as a child of a pre-existing instance of
* inbound {@link MessageContext}.
*/
@@ -95,9 +95,9 @@ public class PopulateOIDCMetadataContext extends AbstractProfileAction {
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
final List<RoleDescriptor> roleDescriptors
- = samlMetadataCtx.getEntityDescriptor().getRoleDescriptors(OAuthRPRoleDescriptorType.TYPE_NAME);
+ = samlMetadataCtx.getEntityDescriptor().getRoleDescriptors(SPSSODescriptor.DEFAULT_ELEMENT_NAME);
for (final RoleDescriptor roleDescriptor : roleDescriptors) {
- if (roleDescriptor instanceof OAuthRPRoleDescriptorType) {
+ if (roleDescriptor instanceof SPSSODescriptor) {
final List<OIDCClientInformation> clientInformations
= roleDescriptor.getObjectMetadata().get(OIDCClientInformation.class);
if (clientInformations != null && clientInformations.size() > 0) {
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
index a61bb7b9..833470f8 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
@@ -17,11 +17,8 @@
</constructor-arg>
</bean>
- <bean id="OIDCRoleDescriptorType" class="javax.xml.namespace.QName">
- <constructor-arg value="urn:mace:shibboleth:metadata:oidc:1.0"/>
- <constructor-arg value="OAuthRPRoleDescriptorType"/>
- <constructor-arg value="oidcmd"/>
- </bean>
+ <util:constant id="shibboleth.MetadataLookup.Role"
+ static-field="org.opensaml.saml.saml2.metadata.SPSSODescriptor.DEFAULT_ELEMENT_NAME" />
<bean id="SAMLProtocolAndRole"
class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor" scope="prototype"
@@ -29,7 +26,7 @@
<constructor-arg name="messageHandler">
<bean class="org.opensaml.saml.common.binding.impl.SAMLProtocolAndRoleHandler" scope="prototype"
p:protocol="http://openid.net/specs/openid-connect-core-1_0.html"
- p:role-ref="OIDCRoleDescriptorType" p:entityContextClass="org.geant.idpextension.oidc.messaging.context.OIDCSAMLPeerEntityContext"/>
+ p:role-ref="shibboleth.MetadataLookup.Role" p:entityContextClass="org.geant.idpextension.oidc.messaging.context.OIDCSAMLPeerEntityContext"/>
</constructor-arg>
</bean>
diff --git a/idp-oidc-extension-impl/src/test/java/org/geant/idpextension/oidc/metadata/impl/ClientInformationNodeProcessorTest.java b/idp-oidc-extension-impl/src/test/java/org/geant/idpextension/oidc/metadata/impl/ClientInformationNodeProcessorTest.java
index 5dfbfc8c..8563a0a2 100644
--- a/idp-oidc-extension-impl/src/test/java/org/geant/idpextension/oidc/metadata/impl/ClientInformationNodeProcessorTest.java
+++ b/idp-oidc-extension-impl/src/test/java/org/geant/idpextension/oidc/metadata/impl/ClientInformationNodeProcessorTest.java
@@ -30,13 +30,13 @@ import org.opensaml.saml.metadata.resolver.filter.impl.NodeProcessingMetadataFil
import org.opensaml.saml.metadata.resolver.impl.FilesystemMetadataResolver;
import org.opensaml.saml.metadata.resolver.impl.PredicateRoleDescriptorResolver;
import org.opensaml.saml.saml2.metadata.RoleDescriptor;
+import org.opensaml.saml.saml2.metadata.SPSSODescriptor;
import org.testng.Assert;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
-import net.shibboleth.idp.saml.oidc.xmlobject.OAuthRPRoleDescriptorType;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
import net.shibboleth.utilities.java.support.resolver.ResolverException;
@@ -81,24 +81,15 @@ public class ClientInformationNodeProcessorTest extends XMLObjectBaseTestCase {
public void testWithValidIndex() throws ResolverException {
RoleDescriptor role = roleResolver.resolveSingle(new CriteriaSet(
new EntityIdCriterion("mockSamlClientId"),
- new EntityRoleCriterion(OAuthRPRoleDescriptorType.DEFAULT_ELEMENT_NAME),
+ new EntityRoleCriterion(SPSSODescriptor.DEFAULT_ELEMENT_NAME),
new ProtocolCriterion("http://openid.net/specs/openid-connect-core-1_0.html")));
Assert.assertNotNull(role);
-
- System.out.println(role.getClass());
- final OAuthRPRoleDescriptorType rp = (OAuthRPRoleDescriptorType) role;
- System.out.println(rp.getRedirectUris().get(0).getValue());
- System.out.println(rp.getRedirectUris().get(1).getValue());
- System.out.println(rp.getResponseTypes().get(0).getValue());
- System.out.println(rp.getGrantTypes().get(0).getValue());
- System.out.println(rp.getApplicationType().getValue());
- System.out.println(rp.getDefaultMaxAge());
- System.out.println(rp.isRequireAuthTime());
-
- final List<OIDCClientInformation> clientInformations = rp.getObjectMetadata().get(OIDCClientInformation.class);
- if (clientInformations != null && clientInformations.size() > 0) {
- System.out.println("Katsos: " + clientInformations.get(0).getID());
- }
+ final SPSSODescriptor sp = (SPSSODescriptor) role;
+ final List<OIDCClientInformation> clientInformations = sp.getObjectMetadata().get(OIDCClientInformation.class);
+ Assert.assertNotNull(clientInformations);
+ Assert.assertEquals(clientInformations.size(), 1);
+ Assert.assertEquals(clientInformations.get(0).getID().getValue(), "mockSamlClientId");
+ Assert.assertEquals(clientInformations.get(0).getOIDCMetadata().getRedirectionURIs().size(), 2);
}
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list