[java-idp-oidc] branch main updated: JOIDC-28 - Pluggable DataSealer and key strategy
Scott Cantor
cantor.2 at osu.edu
Thu Feb 11 15:09:35 UTC 2021
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=0dede029e67aa7efe0501d10beb60e460b01a332
The following commit(s) were added to refs/heads/main by this push:
new 0dede029 JOIDC-28 - Pluggable DataSealer and key strategy
0dede029 is described below
commit 0dede029e67aa7efe0501d10beb60e460b01a332
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Feb 11 10:09:32 2021 -0500
JOIDC-28 - Pluggable DataSealer and key strategy
https://issues.shibboleth.net/jira/browse/JOIDC-28
---
.../resources/META-INF/net.shibboleth.idp/postconfig.xml | 13 +++++++++++++
.../flows/oauth2/introspection/introspection-beans.xml | 3 ++-
.../idp/flows/oauth2/revocation/revocation-beans.xml | 3 ++-
.../idp/flows/oidc/abstract/oidc-abstract-beans.xml | 9 +--------
.../idp/flows/oidc/authorize/authorize-beans.xml | 4 ++--
.../net/shibboleth/idp/flows/oidc/token/token-beans.xml | 15 ++++++++-------
.../shibboleth/idp/flows/oidc/userinfo/token-beans.xml | 9 ++++++---
7 files changed, 34 insertions(+), 22 deletions(-)
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 71ee9fa9..4ea61078 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -25,6 +25,19 @@
<bean parent="shibboleth.AuthnComparisonRegistration"
c:key-ref="shibboleth.OIDCAuthnMethodExact" c:value-ref="shibboleth.ExactMatchFactory" />
+
+ <!-- Sealer used to protect confidentiality and integrity of authorize code, access token and refresh token. -->
+ <bean id="shibboleth.oidc.TokenSealer" lazy-init="true"
+ class="net.shibboleth.utilities.java.support.security.DataSealer"
+ p:encoder-ref="base64Codec"
+ p:decoder-ref="base64Codec"
+ p:keyStrategy-ref="#{ '%{idp.sealer.keyStrategy:shibboleth.DataSealerKeyStrategy}'.trim() }"
+ p:lockedAtStartup="#{!environment.containsProperty('idp.sealer.keyStrategy') and (!environment.containsProperty('idp.sealer.storePassword') or !environment.containsProperty('idp.sealer.keyPassword')) }" />
+
+ <bean id="base64Codec" class="org.apache.commons.codec.binary.Base64" c:lineLength="0"
+ c:lineSeparator="#{new byte[] {10} }" c:urlSafe="true" />
+
+
<!-- OIDC client information resolver service beans. -->
<bean id="shibboleth.ClientInformationResolverService"
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/introspection/introspection-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/introspection/introspection-beans.xml
index 09b06771..ba5097c9 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/introspection/introspection-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/introspection/introspection-beans.xml
@@ -49,7 +49,8 @@
<bean id="FormOutboundMessage"
class="net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.FormOutboundIntrospectionResponseMessage" scope="prototype"
- c:sealer-ref="tokenSealer" p:revocationCache-ref="shibboleth.RevocationCache" />
+ c:sealer-ref="#{'%{idp.oidc.tokenSealer:shibboleth.oidc.TokenSealer}'.trim()}"
+ p:revocationCache-ref="shibboleth.RevocationCache" />
<bean id="BuildErrorResponseFromEvent"
class="net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.BuildIntrospectionErrorResponseFromEvent" scope="prototype"
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/revocation/revocation-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/revocation/revocation-beans.xml
index 642b338b..cf08991a 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/revocation/revocation-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/revocation/revocation-beans.xml
@@ -48,7 +48,8 @@
p:httpServletRequest-ref="shibboleth.HttpServletRequest" p:replayCache-ref="shibboleth.ReplayCache" />
<bean id="RevokeToken" class="net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.RevokeToken" scope="prototype"
- c:sealer-ref="tokenSealer" p:revocationCache-ref="shibboleth.RevocationCache" />
+ c:sealer-ref="#{'%{idp.oidc.tokenSealer:shibboleth.oidc.TokenSealer}'.trim()}"
+ p:revocationCache-ref="shibboleth.RevocationCache" />
<bean id="FormOutboundMessage"
class="net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.FormOutboundRevokeTokenResponseMessage"
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml
index 135a59f3..0e9e736d 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml
@@ -13,20 +13,13 @@
<bean class="net.shibboleth.ext.spring.config.IdentifiableBeanPostProcessor" />
<bean class="net.shibboleth.idp.profile.impl.ProfileActionBeanPostProcessor" />
- <bean id="shibboleth.oidc.loggingId" class="java.lang.String" c:_0="%{idp.service.logging.oidcsso:OIDCSSO}" />
+ <bean id="shibboleth.oidc.loggingId" class="java.lang.String" c:_0="%{idp.service.logging.oidcsso:OIDC.SSO}" />
<bean id="InitializeProfileRequestContext"
class="net.shibboleth.idp.profile.impl.InitializeProfileRequestContext" scope="prototype"
p:profileId-ref="shibboleth.oidc.profileId" p:loggingId-ref="shibboleth.oidc.loggingId"
p:browserProfile-ref="shibboleth.oidc.browserProfile" />
- <!-- Sealer used to protect confidentiality and integrity of authorize code, access token and refresh token. -->
- <bean id="tokenSealer" lazy-init="true" class="net.shibboleth.utilities.java.support.security.DataSealer"
- p:keyStrategy-ref="shibboleth.DataSealerKeyStrategy" p:encoder-ref="base64Codec" p:decoder-ref="base64Codec" />
-
- <bean id="base64Codec" class="org.apache.commons.codec.binary.Base64" c:lineLength="0"
- c:lineSeparator="#{new byte[] {10} }" c:urlSafe="true" />
-
<bean id="shibboleth.oidc.IDTokenSignatureSigningParametersResolver"
class="net.shibboleth.idp.plugin.oidc.op.security.impl.OIDCClientInformationSignatureSigningParametersResolver" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
index 097dd93a..4560c92a 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
@@ -173,7 +173,7 @@
<bean id="SetAuthorizationCodeToResponseContext"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.SetAuthorizationCodeToResponseContext" scope="prototype"
- c:sealer-ref="tokenSealer">
+ c:sealer-ref="#{'%{idp.oidc.tokenSealer:shibboleth.oidc.TokenSealer}'.trim()}">
<property name="identifierGeneratorLookupStrategy">
<bean class="net.shibboleth.idp.profile.config.navigate.IdentifierGenerationStrategyLookupFunction"
p:defaultIdentifierGenerationStrategy-ref="shibboleth.DefaultIdentifierGenerationStrategy" />
@@ -185,7 +185,7 @@
<bean id="SetAccessTokenToResponseContext"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.SetAccessTokenToResponseContext" scope="prototype"
- c:sealer-ref="tokenSealer">
+ c:sealer-ref="#{'%{idp.oidc.tokenSealer:shibboleth.oidc.TokenSealer}'.trim()}">
<property name="activationCondition">
<ref bean="AccessTokenRequested" />
</property>
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
index 04f47f88..95daf251 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
@@ -38,7 +38,8 @@
scope="prototype" />
<bean id="ValidateGrant" class="net.shibboleth.idp.plugin.oidc.op.profile.impl.ValidateGrant" scope="prototype"
- c:sealer-ref="tokenSealer" p:replayCache-ref="shibboleth.ReplayCache"
+ c:sealer-ref="#{'%{idp.oidc.tokenSealer:shibboleth.oidc.TokenSealer}'.trim()}"
+ p:replayCache-ref="shibboleth.ReplayCache"
p:revocationCache-ref="shibboleth.RevocationCache" />
<bean id="ValidatePKCE" class="net.shibboleth.idp.plugin.oidc.op.profile.impl.ValidatePKCE"
@@ -119,17 +120,16 @@
class="net.shibboleth.idp.plugin.oidc.op.security.impl.OIDCClientInformationEncryptionParametersResolver" />
<bean id="shibboleth.TokenRequestScopeLookupStrategy"
- class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestScopeLookupFunction" scope="prototype" />
+ class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestScopeLookupFunction"
+ scope="prototype" />
<bean id="SetAccessTokenToResponseContext"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.SetAccessTokenToResponseContext" scope="prototype"
- c:sealer-ref="tokenSealer">
- </bean>
+ c:sealer-ref="#{'%{idp.oidc.tokenSealer:shibboleth.oidc.TokenSealer}'.trim()}" />
<bean id="SetRefreshTokenToResponseContext"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.SetRefreshTokenToResponseContext" scope="prototype"
- c:sealer-ref="tokenSealer">
- </bean>
+ c:sealer-ref="#{'%{idp.oidc.tokenSealer:shibboleth.oidc.TokenSealer}'.trim()}" />
<bean id="InitializeSubjectContext" class="net.shibboleth.idp.plugin.oidc.op.profile.impl.InitializeSubjectContext"
scope="prototype" />
@@ -157,7 +157,8 @@
<bean id="AddAuthTimeToIDToken" class="net.shibboleth.idp.plugin.oidc.op.profile.impl.AddAuthTimeToIDToken"
scope="prototype" />
- <bean id="AddAcrToIDToken" class="net.shibboleth.idp.plugin.oidc.op.profile.impl.AddAcrToIDToken" scope="prototype" />
+ <bean id="AddAcrToIDToken" class="net.shibboleth.idp.plugin.oidc.op.profile.impl.AddAcrToIDToken"
+ scope="prototype" />
<bean id="AddNonceToIDToken" class="net.shibboleth.idp.plugin.oidc.op.profile.impl.AddNonceToIDToken"
scope="prototype" p:requestNonceLookupStrategy-ref="shibboleth.TokenRequestNonceLookupStrategy" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/token-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/token-beans.xml
index 79e1cde7..8dbfcf6f 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/token-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/token-beans.xml
@@ -21,8 +21,10 @@
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.InitializeOutboundUserInfoResponseMessageContext"
scope="prototype" />
- <bean id="ValidateAccessToken" class="net.shibboleth.idp.plugin.oidc.op.profile.impl.ValidateAccessToken"
- scope="prototype" c:sealer-ref="tokenSealer" p:revocationCache-ref="shibboleth.RevocationCache" />
+ <bean id="ValidateAccessToken"
+ class="net.shibboleth.idp.plugin.oidc.op.profile.impl.ValidateAccessToken" scope="prototype"
+ c:sealer-ref="#{'%{idp.oidc.tokenSealer:shibboleth.oidc.TokenSealer}'.trim()}"
+ p:revocationCache-ref="shibboleth.RevocationCache" />
<bean id="shibboleth.ClientIDLookupStrategy"
class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.UserInfoRequestClientIDLookupFunction"
@@ -36,7 +38,8 @@
p:scopeLookupStrategy-ref="shibboleth.TokenRequestScopeLookupStrategy" />
<bean id="shibboleth.TokenRequestScopeLookupStrategy"
- class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestScopeLookupFunction" scope="prototype" />
+ class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestScopeLookupFunction"
+ scope="prototype" />
<bean id="SetRequestedClaimsToResponseContext"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.SetRequestedClaimsToResponseContext" scope="prototype"
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list