[java-idp-oidc] 12/44: JOIDC-5 Exploits the abstract metadata-lookup flow
Henri Mikkonen
henri.mikkonen at iki.fi
Thu Oct 22 13:08:24 UTC 2020
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=714c0be5856e8f6d8a8cc9a28bc5e8d64d38124c
commit 714c0be5856e8f6d8a8cc9a28bc5e8d64d38124c
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Apr 24 14:20:33 2020 +0300
JOIDC-5 Exploits the abstract metadata-lookup flow
https://issues.shibboleth.net/jira/browse/JOIDC-5
---
.../idp/flows/oidc/authorize/authorize-beans.xml | 63 ++--------------------
.../idp/flows/oidc/authorize/authorize-flow.xml | 24 ++-------
.../idp/flows/oidc/token/token-beans.xml | 20 +------
.../shibboleth/idp/flows/oidc/token/token-flow.xml | 12 +++--
.../idp/flows/oidc/userinfo/token-beans.xml | 20 ++-----
.../idp/flows/oidc/userinfo/token-flow.xml | 10 ++--
6 files changed, 25 insertions(+), 124 deletions(-)
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
index 833470f8..086dae35 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
@@ -17,75 +17,18 @@
</constructor-arg>
</bean>
- <util:constant id="shibboleth.MetadataLookup.Role"
- static-field="org.opensaml.saml.saml2.metadata.SPSSODescriptor.DEFAULT_ELEMENT_NAME" />
-
- <bean id="SAMLProtocolAndRole"
- class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor" scope="prototype"
- c:executionDirection="INBOUND">
- <constructor-arg name="messageHandler">
- <bean class="org.opensaml.saml.common.binding.impl.SAMLProtocolAndRoleHandler" scope="prototype"
- p:protocol="http://openid.net/specs/openid-connect-core-1_0.html"
- p:role-ref="shibboleth.MetadataLookup.Role" p:entityContextClass="org.geant.idpextension.oidc.messaging.context.OIDCSAMLPeerEntityContext"/>
- </constructor-arg>
- </bean>
-
- <bean id="SAMLMetadataLookup"
- class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor" scope="prototype"
- c:executionDirection="INBOUND">
- <constructor-arg name="messageHandler">
- <bean class="org.opensaml.saml.common.binding.impl.SAMLMetadataLookupHandler" scope="prototype"
- p:entityContextClass="org.geant.idpextension.oidc.messaging.context.OIDCSAMLPeerEntityContext">
- <property name="roleDescriptorResolver">
- <bean class="org.opensaml.saml.metadata.resolver.impl.PredicateRoleDescriptorResolver"
- c:mdResolver-ref="shibboleth.MetadataResolver" />
- </property>
- </bean>
- </constructor-arg>
- </bean>
-
- <bean id="shibboleth.ChildLookup.OIDCSAMLPeerEntityContext"
- class="org.opensaml.messaging.context.navigate.ChildContextLookup"
- c:type="#{ T(org.geant.idpextension.oidc.messaging.context.OIDCSAMLPeerEntityContext) }" />
-
- <bean id="shibboleth.ChildLookup.SAMLMetadataContext"
- class="org.opensaml.messaging.context.navigate.ChildContextLookup"
- c:type="#{ T(org.opensaml.saml.common.messaging.context.SAMLMetadataContext) }" />
-
- <bean id="LookupOIDCSAMLPeerEntityContext" class="com.google.common.base.Functions" factory-method="compose"
- c:g-ref="shibboleth.ChildLookup.OIDCSAMLPeerEntityContext"
- c:f-ref="shibboleth.MessageContextLookup.Inbound"/>
-
- <bean id="LookupSAMLMetadataContext" class="com.google.common.base.Functions" factory-method="compose"
- c:g-ref="shibboleth.ChildLookup.SAMLMetadataContext"
- c:f-ref="LookupOIDCSAMLPeerEntityContext"/>
-
- <bean id="PopulateOIDCMetadataContext"
- class="org.geant.idpextension.oidc.profile.impl.PopulateOIDCMetadataContext" scope="prototype"
- p:samlMetadataContextLookupStrategy-ref="LookupSAMLMetadataContext" />
-
<bean id="InitializeAuthenticationContext"
class="org.geant.idpextension.oidc.profile.impl.InitializeAuthenticationContext" scope="prototype" />
<bean id="ProcessRequestedAuthnContext"
class="org.geant.idpextension.oidc.profile.impl.ProcessRequestedAuthnContext" scope="prototype" />
- <bean id="InitializeRelyingPartyContext"
- class="org.geant.idpextension.oidc.profile.impl.InitializeRelyingPartyContext" scope="prototype" />
-
<bean id="PopulateUserAgentContext" class="net.shibboleth.idp.profile.impl.PopulateUserAgentContext"
scope="prototype" p:httpServletRequest-ref="shibboleth.HttpServletRequest" />
- <bean id="OIDCMetadataLookup" class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor"
- scope="prototype" c:executionDirection="INBOUND">
- <constructor-arg name="messageHandler">
- <bean class="org.geant.idpextension.oidc.profile.impl.OIDCMetadataLookupHandler" scope="prototype">
- <property name="clientInformationResolver">
- <ref bean="shibboleth.ClientInformationResolver" />
- </property>
- </bean>
- </constructor-arg>
- </bean>
+ <bean id="shibboleth.ClientIDLookupStrategy"
+ class="org.geant.idpextension.oidc.profile.context.navigate.DefaultClientIDLookupFunction"
+ scope="prototype" />
<bean id="SetRequestedSubjectToResponseContext"
class="org.geant.idpextension.oidc.profile.impl.SetRequestedSubjectToResponseContext" scope="prototype" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-flow.xml
index 5fdbe912..d9336c06 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-flow.xml
@@ -1,7 +1,7 @@
<flow xmlns="http://www.springframework.org/schema/webflow"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/webflow http://www.springframework.org/schema/webflow/spring-webflow.xsd"
- parent="oidc/abstract">
+ parent="oidc/abstract, oidc/metadata-lookup">
<action-state id="InitializeProfileRequestContext">
<evaluate expression="InitializeProfileRequestContext" />
@@ -12,29 +12,11 @@
<action-state id="DecodeMessage">
<evaluate expression="DecodeMessage" />
<evaluate expression="PostDecodePopulateAuditContext" />
- <evaluate expression="SAMLProtocolAndRole" />
- <evaluate expression="SAMLMetadataLookup" />
<evaluate expression="'proceed'" />
- <transition on="proceed" to="CheckIfFoundFromSAMLMetadata" />
- </action-state>
-
- <decision-state id="CheckIfFoundFromSAMLMetadata">
- <if test="opensamlProfileRequestContext.getInboundMessageContext().getSubcontext(T(org.geant.idpextension.oidc.messaging.context.OIDCSAMLPeerEntityContext)).containsSubcontext(T(org.opensaml.saml.common.messaging.context.SAMLMetadataContext))"
- then="PopulateOIDCMetadataContextFromSAML" else="LookupFromClientInformationService" />
- </decision-state>
-
- <action-state id="PopulateOIDCMetadataContextFromSAML">
- <evaluate expression="PopulateOIDCMetadataContext" />
- <evaluate expression="'proceed'" />
- <transition on="proceed" to="SelectConfiguration" />
+ <!-- DoMetadataLookup is expected to proceed to SelectConfiguration -->
+ <transition on="proceed" to="DoMetadataLookup" />
</action-state>
- <action-state id="LookupFromClientInformationService">
- <evaluate expression="OIDCMetadataLookup" />
- <evaluate expression="'proceed'" />
- <transition on="proceed" to="SelectConfiguration" />
- </action-state>
-
<action-state id="SelectConfiguration">
<evaluate expression="InitializeRelyingPartyContext" />
<evaluate expression="SelectRelyingPartyConfiguration" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
index 7a3e6160..f18b536b 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
@@ -16,28 +16,10 @@
</constructor-arg>
</bean>
- <bean id="OIDCMetadataLookup" class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor"
- scope="prototype" c:executionDirection="INBOUND">
- <constructor-arg name="messageHandler">
- <bean class="org.geant.idpextension.oidc.profile.impl.OIDCMetadataLookupHandler" scope="prototype">
- <property name="clientInformationResolver">
- <ref bean="shibboleth.ClientInformationResolver" />
- </property>
- <property name="clientIDLookupStrategy">
- <ref bean="shibboleth.TokenRequestClientIDLookupStrategy" />
- </property>
- </bean>
- </constructor-arg>
- </bean>
-
- <bean id="shibboleth.TokenRequestClientIDLookupStrategy"
+ <bean id="shibboleth.ClientIDLookupStrategy"
class="org.geant.idpextension.oidc.profile.context.navigate.TokenRequestClientIDLookupFunction"
scope="prototype" />
- <bean id="InitializeRelyingPartyContext"
- class="org.geant.idpextension.oidc.profile.impl.InitializeRelyingPartyContext" scope="prototype"
- p:clientIDLookupStrategy-ref="shibboleth.TokenRequestClientIDLookupStrategy" />
-
<bean id="InitializeOutboundMessageContext"
class="org.geant.idpextension.oidc.profile.impl.InitializeOutboundTokenResponseMessageContext" scope="prototype" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-flow.xml
index 9ba4c8a3..a032b6d6 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-flow.xml
@@ -1,6 +1,6 @@
<flow xmlns="http://www.springframework.org/schema/webflow" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/webflow http://www.springframework.org/schema/webflow/spring-webflow.xsd"
- parent="oidc/abstract-api">
+ parent="oidc/abstract-api, oidc/metadata-lookup">
<action-state id="InitializeMandatoryContexts">
<evaluate expression="InitializeProfileRequestContext" />
@@ -12,9 +12,13 @@
<action-state id="DecodeMessage">
<evaluate expression="DecodeMessage" />
<evaluate expression="PostDecodePopulateAuditContext" />
- <evaluate expression="OIDCMetadataLookup" />
- <evaluate expression="InitializeRelyingPartyContext" />
- <evaluate expression="SelectRelyingPartyConfiguration" />
+ <evaluate expression="'proceed'" />
+ <!-- DoMetadataLookup is expected to proceed to SelectConfiguration -->
+ <transition on="proceed" to="DoMetadataLookup" />
+ </action-state>
+
+ <action-state id="SelectConfiguration">
+ <evaluate expression="SelectRelyingPartyConfiguration" />
<evaluate expression="SelectProfileConfiguration" />
<evaluate expression="PostLookupPopulateAuditContext" />
<evaluate expression="'proceed'" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/token-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/token-beans.xml
index a45a848b..89bfaacb 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/token-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/token-beans.xml
@@ -23,28 +23,14 @@
<bean id="ValidateAccessToken" class="org.geant.idpextension.oidc.profile.impl.ValidateAccessToken"
scope="prototype" c:sealer-ref="tokenSealer" p:revocationCache-ref="shibboleth.RevocationCache" />
- <bean id="OIDCMetadataLookup" class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor"
- scope="prototype" c:executionDirection="INBOUND">
- <constructor-arg name="messageHandler">
- <bean class="org.geant.idpextension.oidc.profile.impl.OIDCMetadataLookupHandler" scope="prototype">
- <property name="clientInformationResolver">
- <ref bean="shibboleth.ClientInformationResolver" />
- </property>
- <property name="clientIDLookupStrategy">
- <ref bean="shibboleth.UserInfoRequestClientIDLookupStrategy" />
- </property>
- </bean>
- </constructor-arg>
- </bean>
+ <bean id="shibboleth.ClientIDLookupStrategy"
+ class="org.geant.idpextension.oidc.profile.context.navigate.UserInfoRequestClientIDLookupFunction"
+ scope="prototype" />
<bean id="shibboleth.UserInfoRequestClientIDLookupStrategy"
class="org.geant.idpextension.oidc.profile.context.navigate.UserInfoRequestClientIDLookupFunction"
scope="prototype" />
- <bean id="InitializeRelyingPartyContext"
- class="org.geant.idpextension.oidc.profile.impl.InitializeRelyingPartyContext" scope="prototype"
- p:clientIDLookupStrategy-ref="shibboleth.UserInfoRequestClientIDLookupStrategy" />
-
<bean id="ValidateScope" class="org.geant.idpextension.oidc.profile.impl.ValidateScope" scope="prototype"
p:scopeLookupStrategy-ref="shibboleth.TokenRequestScopeLookupStrategy" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/token-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/token-flow.xml
index e8de793e..ee8226ee 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/token-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/token-flow.xml
@@ -1,7 +1,7 @@
<flow xmlns="http://www.springframework.org/schema/webflow"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/webflow http://www.springframework.org/schema/webflow/spring-webflow.xsd"
- parent="oidc/abstract-api">
+ parent="oidc/abstract-api, oidc/metadata-lookup">
<action-state id="InitializeMandatoryContexts">
<evaluate expression="InitializeProfileRequestContext" />
@@ -14,8 +14,12 @@
<evaluate expression="DecodeMessage" />
<evaluate expression="ValidateAccessToken" />
<evaluate expression="PostDecodePopulateAuditContext" />
- <evaluate expression="OIDCMetadataLookup" />
- <evaluate expression="InitializeRelyingPartyContext" />
+ <evaluate expression="'proceed'" />
+ <!-- DoMetadataLookup is expected to proceed to SelectConfiguration -->
+ <transition on="proceed" to="DoMetadataLookup" />
+ </action-state>
+
+ <action-state id="SelectConfiguration">
<evaluate expression="SelectRelyingPartyConfiguration" />
<evaluate expression="SelectProfileConfiguration" />
<evaluate expression="PostLookupPopulateAuditContext" />
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list