[java-idp-oidc] branch main updated: JCOMOIDC-29 - Consider adjustments to OIDC/OAuth profile configs
Scott Cantor
cantor.2 at osu.edu
Thu Dec 9 00:56:31 UTC 2021
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=d5fa5ba7f30af9944194c94005d8815a3b096345
The following commit(s) were added to refs/heads/main by this push:
new d5fa5ba7 JCOMOIDC-29 - Consider adjustments to OIDC/OAuth profile configs
d5fa5ba7 is described below
commit d5fa5ba7f30af9944194c94005d8815a3b096345
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Dec 8 19:56:28 2021 -0500
JCOMOIDC-29 - Consider adjustments to OIDC/OAuth profile configs
https://shibboleth.atlassian.net/browse/JCOMOIDC-29
Apply upstream changes.
---
.../idp/flows/oidc/abstract/oidc-abstract-beans.xml | 4 +++-
.../shibboleth/idp/flows/oidc/authorize/authorize-beans.xml | 2 +-
.../net/shibboleth/idp/flows/oidc/token/token-beans.xml | 12 ++++++++----
.../net/shibboleth/idp/service/relying-party/postconfig.xml | 12 +++++++++---
.../oidc/op/profile/impl/AddAttributesToClaimsSetTest.java | 4 ++--
.../oidc/op/profile/impl/BaseOIDCResponseActionTest.java | 4 ++--
.../op/profile/impl/SetConsentToResponseContextTest.java | 4 ++--
.../SetTokenDeliveryAttributesToResponseContextTest.java | 8 ++++----
.../idp/plugin/oidc/op/profile/impl/ValidatePKCETest.java | 10 +++++-----
.../src/test/resources/conf/relying-party.xml | 4 ++++
.../impl/EntityDescriptor-with-oidcmd-clientsecret.xml | 2 +-
11 files changed, 41 insertions(+), 25 deletions(-)
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml
index e674acfb..92794552 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml
@@ -17,7 +17,9 @@
<bean id="InitializeProfileRequestContext"
class="net.shibboleth.idp.profile.impl.InitializeProfileRequestContext" scope="prototype"
- p:profileId-ref="shibboleth.oidc.profileId" p:loggingId-ref="shibboleth.oidc.loggingId"
+ p:profileId-ref="shibboleth.oidc.profileId"
+ p:legacyProfileId="#{getObject('shibboleth.oidc.legacyProfileId')}"
+ p:loggingId-ref="shibboleth.oidc.loggingId"
p:browserProfile-ref="shibboleth.oidc.browserProfile" />
<bean id="shibboleth.oidc.IDTokenSignatureSigningParametersResolver"
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
index 043d1f3f..ef383414 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
@@ -9,7 +9,7 @@
<bean id="shibboleth.oidc.browserProfile" class="java.lang.Boolean" c:_0="true" />
<bean id="shibboleth.oidc.profileId" class="java.lang.String"
- c:_0="#{T(net.shibboleth.oidc.profile.config.OIDCCoreProtocolConfiguration).PROFILE_ID}" />
+ c:_0="#{T(net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration).PROFILE_ID}" />
<bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype">
<constructor-arg>
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
index e15f74ad..34f4ca16 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
@@ -3,12 +3,15 @@
xmlns:context="http://www.springframework.org/schema/context" xmlns:p="http://www.springframework.org/schema/p"
xmlns:util="http://www.springframework.org/schema/util" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
default-init-method="initialize" default-destroy-method="destroy">
<bean id="shibboleth.oidc.profileId" class="java.lang.String"
- c:_0="#{T(net.shibboleth.oidc.profile.config.OIDCCoreProtocolConfiguration).PROFILE_ID}" />
+ c:_0="#{T(net.shibboleth.oidc.profile.config.OIDCTokenConfiguration).PROFILE_ID}" />
+
+ <bean id="shibboleth.oidc.legacyProfileId" class="java.lang.String"
+ c:_0="#{T(net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration).PROFILE_ID}" />
<bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype">
<constructor-arg>
@@ -22,7 +25,8 @@
scope="prototype" />
<bean id="InitializeOutboundMessageContext"
- class="net.shibboleth.idp.plugin.oidc.op.profile.impl.InitializeOutboundTokenResponseMessageContext" scope="prototype" />
+ class="net.shibboleth.idp.plugin.oidc.op.profile.impl.InitializeOutboundTokenResponseMessageContext"
+ scope="prototype" />
<bean id="ValidateEndpointAuthentication"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.ValidateEndpointAuthentication" scope="prototype"
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index 3f272190..becf4c4b 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -19,7 +19,7 @@
p:securityConfiguration-ref="%{idp.security.oidc.config:shibboleth.oidc.DefaultSecurityConfiguration}" />
<bean id="OIDC.SSO" parent="AbstractOIDCProfile" lazy-init="true"
- class="net.shibboleth.oidc.profile.config.OIDCCoreProtocolConfiguration"
+ class="net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration"
p:issuer-ref="issuer"
p:iDTokenLifetime="%{idp.oidc.idToken.defaultLifetime:PT1H}"
p:accessTokenLifetime="%{idp.oidc.accessToken.defaultLifetime:PT10M}"
@@ -32,7 +32,10 @@
p:encodedAttributes="%{idp.oidc.encodedAttributes:%{idp.oidc.embeddedAttributes:}}"
p:alwaysIncludedAttributes="%{idp.oidc.alwaysIncludedAttributes:}"
p:deniedUserInfoAttributes="%{idp.oidc.deniedUserInfoAttributes:}" />
-
+
+ <bean id="OIDC.Token" parent="OIDC.SSO" lazy-init="true"
+ class="net.shibboleth.oidc.profile.config.OIDCTokenConfiguration" />
+
<bean id="OIDC.UserInfo" parent="AbstractOIDCProfile" lazy-init="true"
class="net.shibboleth.oidc.profile.config.OIDCUserInfoConfiguration"
p:issuer-ref="issuer"
@@ -107,7 +110,7 @@
</bean>
<bean id="OIDC.SSO.MDDriven" parent="AbstractMDDrivenOIDCFlowAwareProfile" lazy-init="true"
- class="net.shibboleth.oidc.profile.config.OIDCCoreProtocolConfiguration">
+ class="net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration">
<property name="resolveAttributesPredicate">
<bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
<constructor-arg>
@@ -227,6 +230,9 @@
</property>
</bean>
+ <bean id="OIDC.Token.MDDriven" parent="OIDC.SSO.MDDriven" lazy-init="true"
+ class="net.shibboleth.oidc.profile.config.OIDCTokenConfiguration" />
+
<bean id="OIDC.UserInfo.MDDriven" parent="AbstractMDDrivenOIDCProfile" lazy-init="true"
class="net.shibboleth.oidc.profile.config.OIDCUserInfoConfiguration">
<property name="issuerLookupStrategy">
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAttributesToClaimsSetTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAttributesToClaimsSetTest.java
index 5bf93dac..633311cf 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAttributesToClaimsSetTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAttributesToClaimsSetTest.java
@@ -42,7 +42,7 @@ import net.shibboleth.idp.profile.testing.ActionTestingSupport;
import net.shibboleth.oidc.attribute.transcoding.AbstractOIDCAttributeTranscoder;
import net.shibboleth.oidc.attribute.transcoding.OIDCAttributeTranscoder;
import net.shibboleth.oidc.attribute.transcoding.impl.OIDCStringAttributeTranscoder;
-import net.shibboleth.oidc.profile.config.OIDCCoreProtocolConfiguration;
+import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.test.service.MockReloadableService;
@@ -66,7 +66,7 @@ public class AddAttributesToClaimsSetTest extends BaseOIDCResponseActionTest {
@BeforeMethod
public void setup() throws ComponentInitializationException {
- ((OIDCCoreProtocolConfiguration) rpCtx.getProfileConfig()).setAlwaysIncludedAttributes(
+ ((OIDCAuthorizationConfiguration) rpCtx.getProfileConfig()).setAlwaysIncludedAttributes(
Set.of("test1", "test3", "test4"));
registry = new AttributeTranscoderRegistryImpl();
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/BaseOIDCResponseActionTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/BaseOIDCResponseActionTest.java
index 3421d71d..a84600b6 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/BaseOIDCResponseActionTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/BaseOIDCResponseActionTest.java
@@ -32,7 +32,7 @@ import net.shibboleth.idp.plugin.oidc.op.storage.RevocationCache;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
import net.shibboleth.idp.profile.testing.RequestContextBuilder;
-import net.shibboleth.oidc.profile.config.OIDCCoreProtocolConfiguration;
+import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.security.DataSealer;
@@ -154,7 +154,7 @@ public abstract class BaseOIDCResponseActionTest {
rpCtx = profileRequestCtx.getSubcontext(RelyingPartyContext.class, true);
rpCtx.setRelyingPartyId(clientId);
respCtx.setSubject(subject);
- rpCtx.setProfileConfig(new OIDCCoreProtocolConfiguration());
+ rpCtx.setProfileConfig(new OIDCAuthorizationConfiguration());
}
protected void setAuthenticationRequest(final AuthenticationRequest req) {
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetConsentToResponseContextTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetConsentToResponseContextTest.java
index 9d70f423..4f85664b 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetConsentToResponseContextTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetConsentToResponseContextTest.java
@@ -22,7 +22,7 @@ import net.shibboleth.idp.attribute.context.AttributeContext;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseConsentContext;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.testing.ActionTestingSupport;
-import net.shibboleth.oidc.profile.config.OIDCCoreProtocolConfiguration;
+import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import java.util.HashSet;
@@ -49,7 +49,7 @@ public class SetConsentToResponseContextTest extends BaseOIDCResponseActionTest
attributes.add(new IdPAttribute("2"));
attributeCtx.setIdPAttributes(attributes);
rpCtx.addSubcontext(attributeCtx);
- ((OIDCCoreProtocolConfiguration) rpCtx.getProfileConfig()).setEncodeConsentInTokens(encodeConsent);
+ ((OIDCAuthorizationConfiguration) rpCtx.getProfileConfig()).setEncodeConsentInTokens(encodeConsent);
action = new SetConsentToResponseContext();
action.setConsentEnabledPredicate(consentEnabled ? Predicates.alwaysTrue() : Predicates.alwaysFalse());
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetTokenDeliveryAttributesToResponseContextTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetTokenDeliveryAttributesToResponseContextTest.java
index 6031a713..8ceecd02 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetTokenDeliveryAttributesToResponseContextTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetTokenDeliveryAttributesToResponseContextTest.java
@@ -41,7 +41,7 @@ import net.shibboleth.idp.profile.testing.ActionTestingSupport;
import net.shibboleth.oidc.attribute.transcoding.AbstractOIDCAttributeTranscoder;
import net.shibboleth.oidc.attribute.transcoding.OIDCAttributeTranscoder;
import net.shibboleth.oidc.attribute.transcoding.impl.OIDCStringAttributeTranscoder;
-import net.shibboleth.oidc.profile.config.OIDCCoreProtocolConfiguration;
+import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.test.service.MockReloadableService;
@@ -61,13 +61,13 @@ public class SetTokenDeliveryAttributesToResponseContextTest extends BaseOIDCRes
@BeforeMethod
public void setup() throws ComponentInitializationException {
- ((OIDCCoreProtocolConfiguration) rpCtx.getProfileConfig()).setEncodedAttributes(
+ ((OIDCAuthorizationConfiguration) rpCtx.getProfileConfig()).setEncodedAttributes(
Set.of("test1", "test2", "test3"));
- ((OIDCCoreProtocolConfiguration) rpCtx.getProfileConfig()).setAlwaysIncludedAttributes(
+ ((OIDCAuthorizationConfiguration) rpCtx.getProfileConfig()).setAlwaysIncludedAttributes(
Set.of("test2", "test3"));
- ((OIDCCoreProtocolConfiguration) rpCtx.getProfileConfig()).setDeniedUserInfoAttributes(
+ ((OIDCAuthorizationConfiguration) rpCtx.getProfileConfig()).setDeniedUserInfoAttributes(
Collections.singleton("test2"));
registry = new AttributeTranscoderRegistryImpl();
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidatePKCETest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidatePKCETest.java
index b3465df7..100cc309 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidatePKCETest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidatePKCETest.java
@@ -26,7 +26,7 @@ import net.shibboleth.idp.plugin.oidc.op.token.support.AuthorizeCodeClaimsSet;
import net.shibboleth.idp.plugin.oidc.op.token.support.RefreshTokenClaimsSet;
import net.shibboleth.idp.plugin.oidc.op.token.support.TokenClaimsSet;
import net.shibboleth.idp.profile.testing.ActionTestingSupport;
-import net.shibboleth.oidc.profile.config.OIDCCoreProtocolConfiguration;
+import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import org.opensaml.profile.action.EventIds;
@@ -120,7 +120,7 @@ public class ValidatePKCETest extends BaseOIDCResponseActionTest {
*/
@Test
public void testSuccessPlain() throws ComponentInitializationException, URISyntaxException {
- ((OIDCCoreProtocolConfiguration) rpCtx.getProfileConfig()).setAllowPKCEPlain(true);
+ ((OIDCAuthorizationConfiguration) rpCtx.getProfileConfig()).setAllowPKCEPlain(true);
TokenClaimsSet claims =
new AuthorizeCodeClaimsSet.Builder(idGenerator, new ClientID(), "issuer", "userPrin", "subject",
Instant.now(), Instant.now(), Instant.now(), new URI("http://example.com"), new Scope())
@@ -138,7 +138,7 @@ public class ValidatePKCETest extends BaseOIDCResponseActionTest {
*/
@Test
public void testFailPlain() throws ComponentInitializationException, URISyntaxException {
- ((OIDCCoreProtocolConfiguration) rpCtx.getProfileConfig()).setAllowPKCEPlain(true);
+ ((OIDCAuthorizationConfiguration) rpCtx.getProfileConfig()).setAllowPKCEPlain(true);
TokenClaimsSet claims = new AuthorizeCodeClaimsSet.Builder(idGenerator, new ClientID(), "issuer", "userPrin",
"subject", Instant.now(), Instant.now(), Instant.now(), new URI("http://example.com"), new Scope())
.setACR(new ACR("0"))
@@ -172,7 +172,7 @@ public class ValidatePKCETest extends BaseOIDCResponseActionTest {
*/
@Test
public void testFailureNoPKCE() throws ComponentInitializationException, URISyntaxException {
- ((OIDCCoreProtocolConfiguration) rpCtx.getProfileConfig()).setForcePKCE(true);
+ ((OIDCAuthorizationConfiguration) rpCtx.getProfileConfig()).setForcePKCE(true);
TokenRequest req = new TokenRequest(new URI("https://client.com/callback"), new ClientID(clientId),
new AuthorizationCodeGrant(new AuthorizationCode("mockCode"), new URI("https://client.com/callback")));
setTokenRequest(req);
@@ -202,7 +202,7 @@ public class ValidatePKCETest extends BaseOIDCResponseActionTest {
*/
@Test
public void testSuccessNoAuthzCode() throws ComponentInitializationException, URISyntaxException {
- ((OIDCCoreProtocolConfiguration) rpCtx.getProfileConfig()).setForcePKCE(true);
+ ((OIDCAuthorizationConfiguration) rpCtx.getProfileConfig()).setForcePKCE(true);
TokenRequest req = new TokenRequest(new URI("https://client.com/callback"), new ClientID(clientId),
new RefreshTokenGrant(new RefreshToken()));
setTokenRequest(req);
diff --git a/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml b/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml
index 0852e317..4de25ce5 100644
--- a/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml
+++ b/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml
@@ -44,6 +44,7 @@
<ref bean="SAML2.AttributeQuery.MDDriven" />
<ref bean="SAML2.ArtifactResolution.MDDriven" />
<ref bean="OIDC.SSO.MDDriven" />
+ <ref bean="OIDC.Token.MDDriven" />
<ref bean="OIDC.UserInfo.MDDriven" />
<ref bean="OAUTH2.Revocation.MDDriven" />
<ref bean="OAUTH2.Introspection.MDDriven" />
@@ -56,6 +57,7 @@
<property name="profileConfigurations">
<list>
<bean parent="OIDC.SSO.MDDriven" p:forcePKCE="false" p:allowPKCEPlain="true"/>
+ <bean parent="OIDC.Token.MDDriven" p:forcePKCE="false" p:allowPKCEPlain="true"/>
</list>
</property>
</bean>
@@ -63,6 +65,7 @@
<property name="profileConfigurations">
<list>
<bean parent="OIDC.SSO.MDDriven" p:forcePKCE="true" p:allowPKCEPlain="true"/>
+ <bean parent="OIDC.Token.MDDriven" p:forcePKCE="true" p:allowPKCEPlain="true"/>
</list>
</property>
</bean>
@@ -70,6 +73,7 @@
<property name="profileConfigurations">
<list>
<bean parent="OIDC.SSO.MDDriven" p:forcePKCE="true" p:allowPKCEPlain="false"/>
+ <bean parent="OIDC.Token.MDDriven" p:forcePKCE="true" p:allowPKCEPlain="false"/>
</list>
</property>
</bean>
diff --git a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/oidc/metadata/impl/EntityDescriptor-with-oidcmd-clientsecret.xml b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/oidc/metadata/impl/EntityDescriptor-with-oidcmd-clientsecret.xml
index 1630118b..a02c5508 100644
--- a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/oidc/metadata/impl/EntityDescriptor-with-oidcmd-clientsecret.xml
+++ b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/oidc/metadata/impl/EntityDescriptor-with-oidcmd-clientsecret.xml
@@ -2,7 +2,7 @@
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="mockSamlClientId">
<md:Extensions xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute">
<mdattr:EntityAttributes xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
- <saml:Attribute Name="http://shibboleth.net/ns/profiles/oidc/sso/browser/alwaysIncludedAttributes"
+ <saml:Attribute Name="http://shibboleth.net/ns/profiles/oidc/token/alwaysIncludedAttributes"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml:AttributeValue>mail</saml:AttributeValue>
</saml:Attribute>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list