[java-idp-oidc] 10/44: JOIDC-5 Initial version of an abstract metadata-lookup flow
Henri Mikkonen
henri.mikkonen at iki.fi
Thu Oct 22 13:08:22 UTC 2020
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=f5832b10ae89b1d472ec879e4626010894560517
commit f5832b10ae89b1d472ec879e4626010894560517
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Apr 24 14:10:22 2020 +0300
JOIDC-5 Initial version of an abstract metadata-lookup flow
https://issues.shibboleth.net/jira/browse/JOIDC-5
The extending flows can start the metadata resolution by calling
'DoMetadataLookup' state and expect 'SelectConfiguration' to be called
when this flow ends. Subflow didn't seem to be feasible for achieving
the same functionality, as I couldn't find a good way to provide the
some lookup functions to this flow's beans that vary between the flows
that use this (at least authorize, token, endpoint).
---
.../oidc/metadata-lookup/metadata-lookup-beans.xml | 80 ++++++++++++++++++++++
.../oidc/metadata-lookup/metadata-lookup-flow.xml | 44 ++++++++++++
2 files changed, 124 insertions(+)
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/metadata-lookup/metadata-lookup-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/metadata-lookup/metadata-lookup-beans.xml
new file mode 100644
index 00000000..17852c8f
--- /dev/null
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/metadata-lookup/metadata-lookup-beans.xml
@@ -0,0 +1,80 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans" xmlns:c="http://www.springframework.org/schema/c"
+ xmlns:context="http://www.springframework.org/schema/context" xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:util="http://www.springframework.org/schema/util" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+ default-init-method="initialize" default-destroy-method="destroy">
+
+ <util:constant id="shibboleth.MetadataLookup.Role"
+ static-field="org.opensaml.saml.saml2.metadata.SPSSODescriptor.DEFAULT_ELEMENT_NAME" />
+
+ <bean id="SAMLProtocolAndRole"
+ class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor" scope="prototype"
+ c:executionDirection="INBOUND">
+ <constructor-arg name="messageHandler">
+ <bean class="org.opensaml.saml.common.binding.impl.SAMLProtocolAndRoleHandler" scope="prototype"
+ p:protocol="http://openid.net/specs/openid-connect-core-1_0.html"
+ p:role-ref="shibboleth.MetadataLookup.Role" p:entityContextClass="org.geant.idpextension.oidc.messaging.context.OIDCSAMLPeerEntityContext"/>
+ </constructor-arg>
+ </bean>
+
+ <bean id="SetEntityIdToSAMLPeerEntityContext"
+ class="org.geant.idpextension.oidc.profile.impl.SetEntityIdToSAMLPeerEntityContext"
+ p:clientIDLookupStrategy-ref="shibboleth.ClientIDLookupStrategy"
+ p:entityContextClass="org.geant.idpextension.oidc.messaging.context.OIDCSAMLPeerEntityContext" />
+
+ <bean id="InitializeRelyingPartyContext"
+ class="org.geant.idpextension.oidc.profile.impl.InitializeRelyingPartyContext" scope="prototype"
+ p:clientIDLookupStrategy-ref="shibboleth.ClientIDLookupStrategy" />
+
+ <bean id="SAMLMetadataLookup"
+ class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor" scope="prototype"
+ c:executionDirection="INBOUND">
+ <constructor-arg name="messageHandler">
+ <bean class="org.opensaml.saml.common.binding.impl.SAMLMetadataLookupHandler" scope="prototype"
+ p:entityContextClass="org.geant.idpextension.oidc.messaging.context.OIDCSAMLPeerEntityContext">
+ <property name="roleDescriptorResolver">
+ <bean class="org.opensaml.saml.metadata.resolver.impl.PredicateRoleDescriptorResolver"
+ c:mdResolver-ref="shibboleth.MetadataResolver" />
+ </property>
+ </bean>
+ </constructor-arg>
+ </bean>
+
+ <bean id="shibboleth.ChildLookup.OIDCSAMLPeerEntityContext"
+ class="org.opensaml.messaging.context.navigate.ChildContextLookup"
+ c:type="#{ T(org.geant.idpextension.oidc.messaging.context.OIDCSAMLPeerEntityContext) }" />
+
+ <bean id="shibboleth.ChildLookup.SAMLMetadataContext"
+ class="org.opensaml.messaging.context.navigate.ChildContextLookup"
+ c:type="#{ T(org.opensaml.saml.common.messaging.context.SAMLMetadataContext) }" />
+
+ <bean id="LookupOIDCSAMLPeerEntityContext" class="com.google.common.base.Functions" factory-method="compose"
+ c:g-ref="shibboleth.ChildLookup.OIDCSAMLPeerEntityContext"
+ c:f-ref="shibboleth.MessageContextLookup.Inbound"/>
+
+ <bean id="LookupSAMLMetadataContext" class="com.google.common.base.Functions" factory-method="compose"
+ c:g-ref="shibboleth.ChildLookup.SAMLMetadataContext"
+ c:f-ref="LookupOIDCSAMLPeerEntityContext"/>
+
+ <bean id="PopulateOIDCMetadataContext"
+ class="org.geant.idpextension.oidc.profile.impl.PopulateOIDCMetadataContext" scope="prototype"
+ p:samlMetadataContextLookupStrategy-ref="LookupSAMLMetadataContext" />
+
+ <bean id="OIDCMetadataLookup" class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor"
+ scope="prototype" c:executionDirection="INBOUND">
+ <constructor-arg name="messageHandler">
+ <bean class="org.geant.idpextension.oidc.profile.impl.OIDCMetadataLookupHandler" scope="prototype">
+ <property name="clientInformationResolver">
+ <ref bean="shibboleth.ClientInformationResolver" />
+ </property>
+ <property name="clientIDLookupStrategy">
+ <ref bean="shibboleth.ClientIDLookupStrategy" />
+ </property>
+ </bean>
+ </constructor-arg>
+ </bean>
+
+</beans>
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/metadata-lookup/metadata-lookup-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/metadata-lookup/metadata-lookup-flow.xml
new file mode 100644
index 00000000..648464e7
--- /dev/null
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/metadata-lookup/metadata-lookup-flow.xml
@@ -0,0 +1,44 @@
+<flow xmlns="http://www.springframework.org/schema/webflow"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/webflow http://www.springframework.org/schema/webflow/spring-webflow.xsd"
+ abstract="true">
+
+ <action-state id="DoMetadataLookup">
+ <evaluate expression="'proceed'" />
+ <transition on="proceed" to="LookupFromSAMLMetadataService" />
+ </action-state>
+
+ <action-state id="LookupFromSAMLMetadataService">
+ <evaluate expression="SAMLProtocolAndRole" />
+ <evaluate expression="SetEntityIdToSAMLPeerEntityContext" />
+ <evaluate expression="SAMLMetadataLookup" />
+ <evaluate expression="'proceed'" />
+ <transition on="proceed" to="CheckIfFoundFromSAMLMetadata" />
+ </action-state>
+
+ <decision-state id="CheckIfFoundFromSAMLMetadata">
+ <if test="opensamlProfileRequestContext.getInboundMessageContext().getSubcontext(T(org.geant.idpextension.oidc.messaging.context.OIDCSAMLPeerEntityContext)).containsSubcontext(T(org.opensaml.saml.common.messaging.context.SAMLMetadataContext))"
+ then="PopulateOIDCMetadataContextFromSAML" else="LookupFromClientInformationService" />
+ </decision-state>
+
+ <action-state id="PopulateOIDCMetadataContextFromSAML">
+ <evaluate expression="PopulateOIDCMetadataContext" />
+ <evaluate expression="'proceed'" />
+ <transition on="proceed" to="InitializeRelyingPartyContext" />
+ </action-state>
+
+ <action-state id="LookupFromClientInformationService">
+ <evaluate expression="OIDCMetadataLookup" />
+ <evaluate expression="'proceed'" />
+ <transition on="proceed" to="InitializeRelyingPartyContext" />
+ </action-state>
+
+ <action-state id="InitializeRelyingPartyContext">
+ <evaluate expression="InitializeRelyingPartyContext" />
+ <evaluate expression="'proceed'" />
+ <transition on="proceed" to="SelectConfiguration" />
+ </action-state>
+
+ <bean-import resource="../../oidc/metadata-lookup/metadata-lookup-beans.xml" />
+
+</flow>
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list