[java-idp-oidc] branch main updated: Wire in refactored Authorization and Token configs.
Scott Cantor
cantor.2 at osu.edu
Thu Dec 9 18:39:17 UTC 2021
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=befefc0395d52cbb5d8dd540084c8e94f1e8685d
The following commit(s) were added to refs/heads/main by this push:
new befefc03 Wire in refactored Authorization and Token configs.
befefc03 is described below
commit befefc0395d52cbb5d8dd540084c8e94f1e8685d
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Dec 9 13:39:14 2021 -0500
Wire in refactored Authorization and Token configs.
---
.../idp/service/relying-party/postconfig.xml | 184 ++++++++++++---------
1 file changed, 109 insertions(+), 75 deletions(-)
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index becf4c4b..584625d8 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -18,23 +18,29 @@
<bean id="AbstractOIDCProfile" abstract="true"
p:securityConfiguration-ref="%{idp.security.oidc.config:shibboleth.oidc.DefaultSecurityConfiguration}" />
- <bean id="OIDC.SSO" parent="AbstractOIDCProfile" lazy-init="true"
- class="net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration"
+ <bean id="AbstractOIDCSSOProfile" parent="AbstractOIDCProfile" abstract="true"
p:issuer-ref="issuer"
+ p:tokenEndpointAuthMethods="%{idp.oidc.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}"
p:iDTokenLifetime="%{idp.oidc.idToken.defaultLifetime:PT1H}"
p:accessTokenLifetime="%{idp.oidc.accessToken.defaultLifetime:PT10M}"
+ p:alwaysIncludedAttributes="%{idp.oidc.alwaysIncludedAttributes:}" />
+
+ <!-- The final three are really token endpoint settings and should be removed eventually. -->
+ <bean id="OIDC.SSO" parent="AbstractOIDCSSOProfile" lazy-init="true"
+ class="net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration"
p:authorizeCodeLifetime="%{idp.oidc.authorizeCode.defaultLifetime:PT5M}"
- p:refreshTokenLifetime="%{idp.oidc.refreshToken.defaultLifetime:PT2H}"
- p:tokenEndpointAuthMethods="%{idp.oidc.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}"
- p:forcePKCE="%{idp.oidc.forcePKCE:false}"
- p:allowPKCEPlain="%{idp.oidc.allowPKCEPlain:false}"
p:encodeConsentInTokens="%{idp.oidc.encodeConsentInTokens:false}"
p:encodedAttributes="%{idp.oidc.encodedAttributes:%{idp.oidc.embeddedAttributes:}}"
- p:alwaysIncludedAttributes="%{idp.oidc.alwaysIncludedAttributes:}"
- p:deniedUserInfoAttributes="%{idp.oidc.deniedUserInfoAttributes:}" />
-
- <bean id="OIDC.Token" parent="OIDC.SSO" lazy-init="true"
- class="net.shibboleth.oidc.profile.config.OIDCTokenConfiguration" />
+ p:deniedUserInfoAttributes="%{idp.oidc.deniedUserInfoAttributes:}"
+ p:refreshTokenLifetime="%{idp.oidc.refreshToken.defaultLifetime:PT2H}"
+ p:forcePKCE="%{idp.oidc.forcePKCE:false}"
+ p:allowPKCEPlain="%{idp.oidc.allowPKCEPlain:false}" />
+
+ <bean id="OIDC.Token" parent="AbstractOIDCSSOProfile" lazy-init="true"
+ class="net.shibboleth.oidc.profile.config.OIDCTokenConfiguration"
+ p:refreshTokenLifetime="%{idp.oidc.refreshToken.defaultLifetime:PT2H}"
+ p:forcePKCE="%{idp.oidc.forcePKCE:false}"
+ p:allowPKCEPlain="%{idp.oidc.allowPKCEPlain:false}" />
<bean id="OIDC.UserInfo" parent="AbstractOIDCProfile" lazy-init="true"
class="net.shibboleth.oidc.profile.config.OIDCUserInfoConfiguration"
@@ -109,8 +115,20 @@
</property>
</bean>
- <bean id="OIDC.SSO.MDDriven" parent="AbstractMDDrivenOIDCFlowAwareProfile" lazy-init="true"
- class="net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration">
+ <bean id="AbstractMDDrivenOIDCSSOProfile" parent="AbstractMDDrivenOIDCFlowAwareProfile" abstract="true">
+ <property name="issuerLookupStrategy">
+ <bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="issuer" p:defaultValue-ref="issuer" />
+ </property>
+ <property name="tokenEndpointAuthMethodsLookupStrategy">
+ <bean parent="shibboleth.MDDrivenListProperty" p:propertyName="tokenEndpointAuthMethods">
+ <property name="defaultValue">
+ <bean parent="shibboleth.CommaDelimStringArray">
+ <constructor-arg type="java.lang.String"
+ value="%{idp.oidc.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}" />
+ </bean>
+ </property>
+ </bean>
+ </property>
<property name="resolveAttributesPredicate">
<bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
<constructor-arg>
@@ -127,22 +145,43 @@
<constructor-arg value="false" />
</bean>
</property>
- <property name="forcePKCEPredicate">
- <bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
- <constructor-arg>
- <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="forcePKCE" />
- </constructor-arg>
- <constructor-arg value="%{idp.oidc.forcePKCE:false}" />
- </bean>
+ <property name="proxyCountLookupStrategy">
+ <bean parent="shibboleth.MDDrivenIntProperty" p:propertyName="proxyCount" />
</property>
- <property name="allowPKCEPlainPredicate">
- <bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
- <constructor-arg>
- <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="allowPKCEPlain" />
- </constructor-arg>
- <constructor-arg value="%{idp.oidc.allowPKCEPlain:false}" />
+ <property name="authenticationFlowsLookupStrategy">
+ <bean parent="shibboleth.MDDrivenSetProperty" p:propertyName="authenticationFlows" />
+ </property>
+ <property name="postAuthenticationFlowsLookupStrategy">
+ <bean parent="shibboleth.MDDrivenListProperty" p:propertyName="postAuthenticationFlows" />
+ </property>
+ <property name="defaultAuthenticationMethodsLookupStrategy">
+ <bean parent="shibboleth.MDDrivenListProperty" p:propertyName="defaultAuthenticationMethods"
+ p:propertyType="#{T(net.shibboleth.oidc.authn.principal.AuthenticationContextClassReferencePrincipal)}" />
+ </property>
+ <property name="iDTokenLifetimeLookupStrategy">
+ <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="iDTokenLifetime"
+ p:defaultValue="%{idp.oidc.idToken.defaultLifetime:PT1H}" />
+ </property>
+ <property name="accessTokenLifetimeLookupStrategy">
+ <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="accessTokenLifetime"
+ p:defaultValue="%{idp.oidc.accessToken.defaultLifetime:PT10M}" />
+ </property>
+ <property name="additionalAudiencesForIdTokenLookupStrategy">
+ <bean parent="shibboleth.MDDrivenSetProperty" p:propertyName="tokenAudiences" />
+ </property>
+ <property name="alwaysIncludedAttributesLookupStrategy">
+ <bean parent="shibboleth.MDDrivenSetProperty" p:propertyName="alwaysIncludedAttributes">
+ <property name="defaultValue">
+ <bean parent="shibboleth.CommaDelimStringArray">
+ <constructor-arg type="java.lang.String" value="%{idp.oidc.alwaysIncludedAttributes:}" />
+ </bean>
+ </property>
</bean>
</property>
+ </bean>
+
+ <bean id="OIDC.SSO.MDDriven" parent="AbstractMDDrivenOIDCSSOProfile" lazy-init="true"
+ class="net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration">
<property name="acrRequestAlwaysEssentialPredicate">
<bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
<constructor-arg>
@@ -159,48 +198,10 @@
<constructor-arg value="%{idp.oidc.encodeConsentInTokens:false}" />
</bean>
</property>
- <property name="issuerLookupStrategy">
- <bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="issuer" p:defaultValue-ref="issuer" />
- </property>
- <property name="iDTokenLifetimeLookupStrategy">
- <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="iDTokenLifetime"
- p:defaultValue="%{idp.oidc.idToken.defaultLifetime:PT1H}" />
- </property>
- <property name="accessTokenLifetimeLookupStrategy">
- <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="accessTokenLifetime"
- p:defaultValue="%{idp.oidc.accessToken.defaultLifetime:PT10M}" />
- </property>
<property name="authorizeCodeLifetimeLookupStrategy">
<bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="authorizeCodeLifetime"
p:defaultValue="%{idp.oidc.authorizeCode.defaultLifetime:PT5M}" />
</property>
- <property name="refreshTokenLifetimeLookupStrategy">
- <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="refreshTokenLifetime"
- p:defaultValue="%{idp.oidc.refreshToken.defaultLifetime:PT2H}" />
- </property>
- <property name="tokenEndpointAuthMethodsLookupStrategy">
- <bean parent="shibboleth.MDDrivenListProperty" p:propertyName="tokenEndpointAuthMethods">
- <property name="defaultValue">
- <bean parent="shibboleth.CommaDelimStringArray">
- <constructor-arg type="java.lang.String"
- value="%{idp.oidc.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}" />
- </bean>
- </property>
- </bean>
- </property>
- <property name="proxyCountLookupStrategy">
- <bean parent="shibboleth.MDDrivenIntProperty" p:propertyName="proxyCount" />
- </property>
- <property name="postAuthenticationFlowsLookupStrategy">
- <bean parent="shibboleth.MDDrivenListProperty" p:propertyName="postAuthenticationFlows" />
- </property>
- <property name="additionalAudiencesForIdTokenLookupStrategy">
- <bean parent="shibboleth.MDDrivenSetProperty" p:propertyName="tokenAudiences" />
- </property>
- <property name="defaultAuthenticationMethodsLookupStrategy">
- <bean parent="shibboleth.MDDrivenListProperty" p:propertyName="defaultAuthenticationMethods"
- p:propertyType="#{T(net.shibboleth.oidc.authn.principal.AuthenticationContextClassReferencePrincipal)}" />
- </property>
<property name="encodedAttributesLookupStrategy">
<bean parent="shibboleth.MDDrivenSetProperty" p:propertyName="encodedAttributes">
<property name="defaultValue">
@@ -210,15 +211,6 @@
</property>
</bean>
</property>
- <property name="alwaysIncludedAttributesLookupStrategy">
- <bean parent="shibboleth.MDDrivenSetProperty" p:propertyName="alwaysIncludedAttributes">
- <property name="defaultValue">
- <bean parent="shibboleth.CommaDelimStringArray">
- <constructor-arg type="java.lang.String" value="%{idp.oidc.alwaysIncludedAttributes:}" />
- </bean>
- </property>
- </bean>
- </property>
<property name="deniedUserInfoAttributesLookupStrategy">
<bean parent="shibboleth.MDDrivenSetProperty" p:propertyName="deniedUserInfoAttributes">
<property name="defaultValue">
@@ -228,10 +220,52 @@
</property>
</bean>
</property>
+ <!-- Last 3 are marked for removal. -->
+ <property name="forcePKCEPredicate">
+ <bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="forcePKCE" />
+ </constructor-arg>
+ <constructor-arg value="%{idp.oidc.forcePKCE:false}" />
+ </bean>
+ </property>
+ <property name="allowPKCEPlainPredicate">
+ <bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="allowPKCEPlain" />
+ </constructor-arg>
+ <constructor-arg value="%{idp.oidc.allowPKCEPlain:false}" />
+ </bean>
+ </property>
+ <property name="refreshTokenLifetimeLookupStrategy">
+ <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="refreshTokenLifetime"
+ p:defaultValue="%{idp.oidc.refreshToken.defaultLifetime:PT2H}" />
+ </property>
</bean>
- <bean id="OIDC.Token.MDDriven" parent="OIDC.SSO.MDDriven" lazy-init="true"
- class="net.shibboleth.oidc.profile.config.OIDCTokenConfiguration" />
+ <bean id="OIDC.Token.MDDriven" parent="AbstractMDDrivenOIDCSSOProfile" lazy-init="true"
+ class="net.shibboleth.oidc.profile.config.OIDCTokenConfiguration">
+ <property name="forcePKCEPredicate">
+ <bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="forcePKCE" />
+ </constructor-arg>
+ <constructor-arg value="%{idp.oidc.forcePKCE:false}" />
+ </bean>
+ </property>
+ <property name="allowPKCEPlainPredicate">
+ <bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="allowPKCEPlain" />
+ </constructor-arg>
+ <constructor-arg value="%{idp.oidc.allowPKCEPlain:false}" />
+ </bean>
+ </property>
+ <property name="refreshTokenLifetimeLookupStrategy">
+ <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="refreshTokenLifetime"
+ p:defaultValue="%{idp.oidc.refreshToken.defaultLifetime:PT2H}" />
+ </property>
+ </bean>
<bean id="OIDC.UserInfo.MDDriven" parent="AbstractMDDrivenOIDCProfile" lazy-init="true"
class="net.shibboleth.oidc.profile.config.OIDCUserInfoConfiguration">
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list