[java-idp-oidc] branch main updated: JCOMOIDC-29 - Consider adjustments to OIDC/OAuth profile configs

Scott Cantor cantor.2 at osu.edu
Thu Dec 9 00:56:31 UTC 2021


This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=d5fa5ba7f30af9944194c94005d8815a3b096345

The following commit(s) were added to refs/heads/main by this push:
     new d5fa5ba7 JCOMOIDC-29 - Consider adjustments to OIDC/OAuth profile configs
d5fa5ba7 is described below

commit d5fa5ba7f30af9944194c94005d8815a3b096345
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Dec 8 19:56:28 2021 -0500

    JCOMOIDC-29 - Consider adjustments to OIDC/OAuth profile configs
    
    https://shibboleth.atlassian.net/browse/JCOMOIDC-29
    
    Apply upstream changes.
---
 .../idp/flows/oidc/abstract/oidc-abstract-beans.xml          |  4 +++-
 .../shibboleth/idp/flows/oidc/authorize/authorize-beans.xml  |  2 +-
 .../net/shibboleth/idp/flows/oidc/token/token-beans.xml      | 12 ++++++++----
 .../net/shibboleth/idp/service/relying-party/postconfig.xml  | 12 +++++++++---
 .../oidc/op/profile/impl/AddAttributesToClaimsSetTest.java   |  4 ++--
 .../oidc/op/profile/impl/BaseOIDCResponseActionTest.java     |  4 ++--
 .../op/profile/impl/SetConsentToResponseContextTest.java     |  4 ++--
 .../SetTokenDeliveryAttributesToResponseContextTest.java     |  8 ++++----
 .../idp/plugin/oidc/op/profile/impl/ValidatePKCETest.java    | 10 +++++-----
 .../src/test/resources/conf/relying-party.xml                |  4 ++++
 .../impl/EntityDescriptor-with-oidcmd-clientsecret.xml       |  2 +-
 11 files changed, 41 insertions(+), 25 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml
index e674acfb..92794552 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml
@@ -17,7 +17,9 @@
 
     <bean id="InitializeProfileRequestContext"
         class="net.shibboleth.idp.profile.impl.InitializeProfileRequestContext" scope="prototype"
-        p:profileId-ref="shibboleth.oidc.profileId" p:loggingId-ref="shibboleth.oidc.loggingId"
+        p:profileId-ref="shibboleth.oidc.profileId"
+        p:legacyProfileId="#{getObject('shibboleth.oidc.legacyProfileId')}"
+        p:loggingId-ref="shibboleth.oidc.loggingId"
         p:browserProfile-ref="shibboleth.oidc.browserProfile" />
     
     <bean id="shibboleth.oidc.IDTokenSignatureSigningParametersResolver"
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
index 043d1f3f..ef383414 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
@@ -9,7 +9,7 @@
 
     <bean id="shibboleth.oidc.browserProfile" class="java.lang.Boolean" c:_0="true" />
     <bean id="shibboleth.oidc.profileId" class="java.lang.String"
-        c:_0="#{T(net.shibboleth.oidc.profile.config.OIDCCoreProtocolConfiguration).PROFILE_ID}" />
+        c:_0="#{T(net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration).PROFILE_ID}" />
 
     <bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype">
         <constructor-arg>
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
index e15f74ad..34f4ca16 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
@@ -3,12 +3,15 @@
     xmlns:context="http://www.springframework.org/schema/context" xmlns:p="http://www.springframework.org/schema/p"
     xmlns:util="http://www.springframework.org/schema/util" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
     xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
-                           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
-                           http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+                        http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+                        http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
     default-init-method="initialize" default-destroy-method="destroy">
 
     <bean id="shibboleth.oidc.profileId" class="java.lang.String"
-        c:_0="#{T(net.shibboleth.oidc.profile.config.OIDCCoreProtocolConfiguration).PROFILE_ID}" />
+        c:_0="#{T(net.shibboleth.oidc.profile.config.OIDCTokenConfiguration).PROFILE_ID}" />
+
+    <bean id="shibboleth.oidc.legacyProfileId" class="java.lang.String"
+        c:_0="#{T(net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration).PROFILE_ID}" />
 
     <bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype">
         <constructor-arg>
@@ -22,7 +25,8 @@
         scope="prototype" />
 
     <bean id="InitializeOutboundMessageContext"
-        class="net.shibboleth.idp.plugin.oidc.op.profile.impl.InitializeOutboundTokenResponseMessageContext" scope="prototype" />
+        class="net.shibboleth.idp.plugin.oidc.op.profile.impl.InitializeOutboundTokenResponseMessageContext"
+        scope="prototype" />
 
     <bean id="ValidateEndpointAuthentication"
         class="net.shibboleth.idp.plugin.oidc.op.profile.impl.ValidateEndpointAuthentication" scope="prototype"
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index 3f272190..becf4c4b 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -19,7 +19,7 @@
         p:securityConfiguration-ref="%{idp.security.oidc.config:shibboleth.oidc.DefaultSecurityConfiguration}" />
     
     <bean id="OIDC.SSO" parent="AbstractOIDCProfile" lazy-init="true"
-        class="net.shibboleth.oidc.profile.config.OIDCCoreProtocolConfiguration"
+        class="net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration"
         p:issuer-ref="issuer"
         p:iDTokenLifetime="%{idp.oidc.idToken.defaultLifetime:PT1H}"
         p:accessTokenLifetime="%{idp.oidc.accessToken.defaultLifetime:PT10M}"
@@ -32,7 +32,10 @@
         p:encodedAttributes="%{idp.oidc.encodedAttributes:%{idp.oidc.embeddedAttributes:}}"
         p:alwaysIncludedAttributes="%{idp.oidc.alwaysIncludedAttributes:}"
         p:deniedUserInfoAttributes="%{idp.oidc.deniedUserInfoAttributes:}" />
-        
+    
+    <bean id="OIDC.Token" parent="OIDC.SSO" lazy-init="true"
+        class="net.shibboleth.oidc.profile.config.OIDCTokenConfiguration" />
+    
     <bean id="OIDC.UserInfo" parent="AbstractOIDCProfile" lazy-init="true"
         class="net.shibboleth.oidc.profile.config.OIDCUserInfoConfiguration"
         p:issuer-ref="issuer"
@@ -107,7 +110,7 @@
     </bean>
     
     <bean id="OIDC.SSO.MDDriven" parent="AbstractMDDrivenOIDCFlowAwareProfile" lazy-init="true"
-            class="net.shibboleth.oidc.profile.config.OIDCCoreProtocolConfiguration">
+            class="net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration">
         <property name="resolveAttributesPredicate">
             <bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
                 <constructor-arg>
@@ -227,6 +230,9 @@
         </property>
     </bean>
     
+    <bean id="OIDC.Token.MDDriven" parent="OIDC.SSO.MDDriven" lazy-init="true"
+        class="net.shibboleth.oidc.profile.config.OIDCTokenConfiguration" />
+    
     <bean id="OIDC.UserInfo.MDDriven" parent="AbstractMDDrivenOIDCProfile" lazy-init="true"
             class="net.shibboleth.oidc.profile.config.OIDCUserInfoConfiguration">
         <property name="issuerLookupStrategy">
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAttributesToClaimsSetTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAttributesToClaimsSetTest.java
index 5bf93dac..633311cf 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAttributesToClaimsSetTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAttributesToClaimsSetTest.java
@@ -42,7 +42,7 @@ import net.shibboleth.idp.profile.testing.ActionTestingSupport;
 import net.shibboleth.oidc.attribute.transcoding.AbstractOIDCAttributeTranscoder;
 import net.shibboleth.oidc.attribute.transcoding.OIDCAttributeTranscoder;
 import net.shibboleth.oidc.attribute.transcoding.impl.OIDCStringAttributeTranscoder;
-import net.shibboleth.oidc.profile.config.OIDCCoreProtocolConfiguration;
+import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
 import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
 import net.shibboleth.utilities.java.support.test.service.MockReloadableService;
 
@@ -66,7 +66,7 @@ public class AddAttributesToClaimsSetTest extends BaseOIDCResponseActionTest {
     @BeforeMethod
     public void setup() throws ComponentInitializationException {
         
-        ((OIDCCoreProtocolConfiguration) rpCtx.getProfileConfig()).setAlwaysIncludedAttributes(
+        ((OIDCAuthorizationConfiguration) rpCtx.getProfileConfig()).setAlwaysIncludedAttributes(
                 Set.of("test1", "test3", "test4"));
         
         registry = new AttributeTranscoderRegistryImpl();
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/BaseOIDCResponseActionTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/BaseOIDCResponseActionTest.java
index 3421d71d..a84600b6 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/BaseOIDCResponseActionTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/BaseOIDCResponseActionTest.java
@@ -32,7 +32,7 @@ import net.shibboleth.idp.plugin.oidc.op.storage.RevocationCache;
 import net.shibboleth.idp.profile.context.RelyingPartyContext;
 import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
 import net.shibboleth.idp.profile.testing.RequestContextBuilder;
-import net.shibboleth.oidc.profile.config.OIDCCoreProtocolConfiguration;
+import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
 import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
 import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
 import net.shibboleth.utilities.java.support.security.DataSealer;
@@ -154,7 +154,7 @@ public abstract class BaseOIDCResponseActionTest {
         rpCtx = profileRequestCtx.getSubcontext(RelyingPartyContext.class, true);
         rpCtx.setRelyingPartyId(clientId);
         respCtx.setSubject(subject);
-        rpCtx.setProfileConfig(new OIDCCoreProtocolConfiguration());
+        rpCtx.setProfileConfig(new OIDCAuthorizationConfiguration());
     }
 
     protected void setAuthenticationRequest(final AuthenticationRequest req) {
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetConsentToResponseContextTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetConsentToResponseContextTest.java
index 9d70f423..4f85664b 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetConsentToResponseContextTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetConsentToResponseContextTest.java
@@ -22,7 +22,7 @@ import net.shibboleth.idp.attribute.context.AttributeContext;
 import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseConsentContext;
 import net.shibboleth.idp.profile.context.RelyingPartyContext;
 import net.shibboleth.idp.profile.testing.ActionTestingSupport;
-import net.shibboleth.oidc.profile.config.OIDCCoreProtocolConfiguration;
+import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
 import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
 
 import java.util.HashSet;
@@ -49,7 +49,7 @@ public class SetConsentToResponseContextTest extends BaseOIDCResponseActionTest
         attributes.add(new IdPAttribute("2"));
         attributeCtx.setIdPAttributes(attributes);
         rpCtx.addSubcontext(attributeCtx);
-        ((OIDCCoreProtocolConfiguration) rpCtx.getProfileConfig()).setEncodeConsentInTokens(encodeConsent);
+        ((OIDCAuthorizationConfiguration) rpCtx.getProfileConfig()).setEncodeConsentInTokens(encodeConsent);
         action = new SetConsentToResponseContext();
         action.setConsentEnabledPredicate(consentEnabled ? Predicates.alwaysTrue() : Predicates.alwaysFalse());
         
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetTokenDeliveryAttributesToResponseContextTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetTokenDeliveryAttributesToResponseContextTest.java
index 6031a713..8ceecd02 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetTokenDeliveryAttributesToResponseContextTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetTokenDeliveryAttributesToResponseContextTest.java
@@ -41,7 +41,7 @@ import net.shibboleth.idp.profile.testing.ActionTestingSupport;
 import net.shibboleth.oidc.attribute.transcoding.AbstractOIDCAttributeTranscoder;
 import net.shibboleth.oidc.attribute.transcoding.OIDCAttributeTranscoder;
 import net.shibboleth.oidc.attribute.transcoding.impl.OIDCStringAttributeTranscoder;
-import net.shibboleth.oidc.profile.config.OIDCCoreProtocolConfiguration;
+import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
 import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
 import net.shibboleth.utilities.java.support.test.service.MockReloadableService;
 
@@ -61,13 +61,13 @@ public class SetTokenDeliveryAttributesToResponseContextTest extends BaseOIDCRes
     @BeforeMethod
     public void setup() throws ComponentInitializationException {
         
-        ((OIDCCoreProtocolConfiguration) rpCtx.getProfileConfig()).setEncodedAttributes(
+        ((OIDCAuthorizationConfiguration) rpCtx.getProfileConfig()).setEncodedAttributes(
                 Set.of("test1", "test2", "test3"));
 
-        ((OIDCCoreProtocolConfiguration) rpCtx.getProfileConfig()).setAlwaysIncludedAttributes(
+        ((OIDCAuthorizationConfiguration) rpCtx.getProfileConfig()).setAlwaysIncludedAttributes(
                 Set.of("test2", "test3"));
 
-        ((OIDCCoreProtocolConfiguration) rpCtx.getProfileConfig()).setDeniedUserInfoAttributes(
+        ((OIDCAuthorizationConfiguration) rpCtx.getProfileConfig()).setDeniedUserInfoAttributes(
                 Collections.singleton("test2"));
 
         registry = new AttributeTranscoderRegistryImpl();
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidatePKCETest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidatePKCETest.java
index b3465df7..100cc309 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidatePKCETest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidatePKCETest.java
@@ -26,7 +26,7 @@ import net.shibboleth.idp.plugin.oidc.op.token.support.AuthorizeCodeClaimsSet;
 import net.shibboleth.idp.plugin.oidc.op.token.support.RefreshTokenClaimsSet;
 import net.shibboleth.idp.plugin.oidc.op.token.support.TokenClaimsSet;
 import net.shibboleth.idp.profile.testing.ActionTestingSupport;
-import net.shibboleth.oidc.profile.config.OIDCCoreProtocolConfiguration;
+import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
 import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
 
 import org.opensaml.profile.action.EventIds;
@@ -120,7 +120,7 @@ public class ValidatePKCETest extends BaseOIDCResponseActionTest {
      */
     @Test
     public void testSuccessPlain() throws ComponentInitializationException, URISyntaxException {
-        ((OIDCCoreProtocolConfiguration) rpCtx.getProfileConfig()).setAllowPKCEPlain(true);
+        ((OIDCAuthorizationConfiguration) rpCtx.getProfileConfig()).setAllowPKCEPlain(true);
         TokenClaimsSet claims =
                 new AuthorizeCodeClaimsSet.Builder(idGenerator, new ClientID(), "issuer", "userPrin", "subject",
                         Instant.now(), Instant.now(), Instant.now(), new URI("http://example.com"), new Scope())
@@ -138,7 +138,7 @@ public class ValidatePKCETest extends BaseOIDCResponseActionTest {
      */
     @Test
     public void testFailPlain() throws ComponentInitializationException, URISyntaxException {
-        ((OIDCCoreProtocolConfiguration) rpCtx.getProfileConfig()).setAllowPKCEPlain(true);
+        ((OIDCAuthorizationConfiguration) rpCtx.getProfileConfig()).setAllowPKCEPlain(true);
         TokenClaimsSet claims = new AuthorizeCodeClaimsSet.Builder(idGenerator, new ClientID(), "issuer", "userPrin",
                 "subject", Instant.now(), Instant.now(), Instant.now(), new URI("http://example.com"), new Scope())
                         .setACR(new ACR("0"))
@@ -172,7 +172,7 @@ public class ValidatePKCETest extends BaseOIDCResponseActionTest {
      */
     @Test
     public void testFailureNoPKCE() throws ComponentInitializationException, URISyntaxException {
-        ((OIDCCoreProtocolConfiguration) rpCtx.getProfileConfig()).setForcePKCE(true);
+        ((OIDCAuthorizationConfiguration) rpCtx.getProfileConfig()).setForcePKCE(true);
         TokenRequest req = new TokenRequest(new URI("https://client.com/callback"), new ClientID(clientId),
                 new AuthorizationCodeGrant(new AuthorizationCode("mockCode"), new URI("https://client.com/callback")));
         setTokenRequest(req);
@@ -202,7 +202,7 @@ public class ValidatePKCETest extends BaseOIDCResponseActionTest {
      */
     @Test
     public void testSuccessNoAuthzCode() throws ComponentInitializationException, URISyntaxException {
-        ((OIDCCoreProtocolConfiguration) rpCtx.getProfileConfig()).setForcePKCE(true);
+        ((OIDCAuthorizationConfiguration) rpCtx.getProfileConfig()).setForcePKCE(true);
         TokenRequest req = new TokenRequest(new URI("https://client.com/callback"), new ClientID(clientId),
                 new RefreshTokenGrant(new RefreshToken()));
         setTokenRequest(req);
diff --git a/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml b/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml
index 0852e317..4de25ce5 100644
--- a/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml
+++ b/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml
@@ -44,6 +44,7 @@
                 <ref bean="SAML2.AttributeQuery.MDDriven" />
                 <ref bean="SAML2.ArtifactResolution.MDDriven" />
                 <ref bean="OIDC.SSO.MDDriven" />
+                <ref bean="OIDC.Token.MDDriven" />
                 <ref bean="OIDC.UserInfo.MDDriven" />
                 <ref bean="OAUTH2.Revocation.MDDriven" />
                 <ref bean="OAUTH2.Introspection.MDDriven" />
@@ -56,6 +57,7 @@
             <property name="profileConfigurations">
                  <list>
                      <bean parent="OIDC.SSO.MDDriven" p:forcePKCE="false" p:allowPKCEPlain="true"/>
+                     <bean parent="OIDC.Token.MDDriven" p:forcePKCE="false" p:allowPKCEPlain="true"/>
                  </list>
             </property>
         </bean>
@@ -63,6 +65,7 @@
             <property name="profileConfigurations">
                  <list>
                      <bean parent="OIDC.SSO.MDDriven" p:forcePKCE="true" p:allowPKCEPlain="true"/>
+                     <bean parent="OIDC.Token.MDDriven" p:forcePKCE="true" p:allowPKCEPlain="true"/>
                  </list>
             </property>
         </bean>
@@ -70,6 +73,7 @@
             <property name="profileConfigurations">
                  <list>
                      <bean parent="OIDC.SSO.MDDriven" p:forcePKCE="true" p:allowPKCEPlain="false"/>
+                     <bean parent="OIDC.Token.MDDriven" p:forcePKCE="true" p:allowPKCEPlain="false"/>
                  </list>
             </property>
         </bean>
diff --git a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/oidc/metadata/impl/EntityDescriptor-with-oidcmd-clientsecret.xml b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/oidc/metadata/impl/EntityDescriptor-with-oidcmd-clientsecret.xml
index 1630118b..a02c5508 100644
--- a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/oidc/metadata/impl/EntityDescriptor-with-oidcmd-clientsecret.xml
+++ b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/oidc/metadata/impl/EntityDescriptor-with-oidcmd-clientsecret.xml
@@ -2,7 +2,7 @@
 <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="mockSamlClientId">
     <md:Extensions xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute">
         <mdattr:EntityAttributes xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
-            <saml:Attribute Name="http://shibboleth.net/ns/profiles/oidc/sso/browser/alwaysIncludedAttributes"
+            <saml:Attribute Name="http://shibboleth.net/ns/profiles/oidc/token/alwaysIncludedAttributes"
                 NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
                 <saml:AttributeValue>mail</saml:AttributeValue>
             </saml:Attribute>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the commits mailing list