[java-idp-oidc] branch main updated: Fix application of dynreg lifetime and client secret defaults.
Scott Cantor
cantor.2 at osu.edu
Thu Feb 11 23:19:47 UTC 2021
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=4bbc46fcd2d1eb83d78a998bdefefc111ff6a9d6
The following commit(s) were added to refs/heads/main by this push:
new 4bbc46fc Fix application of dynreg lifetime and client secret defaults.
4bbc46fc is described below
commit 4bbc46fcd2d1eb83d78a998bdefefc111ff6a9d6
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Feb 11 18:19:18 2021 -0500
Fix application of dynreg lifetime and client secret defaults.
---
.../OIDCDynamicRegistrationConfiguration.java | 4 ++--
.../oidc/op/profile/impl/GenerateClientSecret.java | 23 +++-----------------
.../op/profile/impl/StoreClientInformation.java | 25 +++-------------------
.../idp/flows/oidc/register/register-beans.xml | 12 ++++-------
.../idp/service/relying-party/postconfig.xml | 8 +++++--
5 files changed, 18 insertions(+), 54 deletions(-)
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/OIDCDynamicRegistrationConfiguration.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/OIDCDynamicRegistrationConfiguration.java
index f50065c5..bce3b790 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/OIDCDynamicRegistrationConfiguration.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/OIDCDynamicRegistrationConfiguration.java
@@ -67,8 +67,8 @@ public class OIDCDynamicRegistrationConfiguration extends AbstractOIDCFlowAwareP
public OIDCDynamicRegistrationConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
issuerLookupStrategy = FunctionSupport.constant(null);
- setRegistrationValidityPeriod(Duration.ZERO);
- setSecretExpirationPeriod(Duration.ZERO);
+ setRegistrationValidityPeriod(Duration.ofHours(24));
+ setSecretExpirationPeriod(Duration.ofDays(365));
}
/** {@inheritDoc} */
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/GenerateClientSecret.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/GenerateClientSecret.java
index 8695223b..12f5dbdc 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/GenerateClientSecret.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/GenerateClientSecret.java
@@ -34,7 +34,6 @@ import org.slf4j.LoggerFactory;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCClientRegistrationResponseContext;
import net.shibboleth.idp.profile.AbstractProfileAction;
-import net.shibboleth.utilities.java.support.annotation.constraint.NonNegative;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.logic.FunctionSupport;
@@ -68,15 +67,11 @@ public class GenerateClientSecret extends AbstractProfileAction {
/** Strategy to obtain client secret validity period policy. */
@Nullable private Function<ProfileRequestContext,Duration> secretExpirationPeriodStrategy;
-
- /** Default validity period for client secret. */
- @NonNegative @Nonnull private Duration defaultSecretExpirationPeriod;
/** Constructor. */
public GenerateClientSecret() {
oidcResponseContextLookupStrategy = new ChildContextLookup<>(OIDCClientRegistrationResponseContext.class);
idGeneratorLookupStrategy = FunctionSupport.constant(new SecureRandomIdentifierGenerationStrategy());
- defaultSecretExpirationPeriod = Duration.ofDays(365);
}
/**
@@ -89,19 +84,6 @@ public class GenerateClientSecret extends AbstractProfileAction {
secretExpirationPeriodStrategy = strategy;
}
-
- /**
- * Set the default expiration period for client secret.
- *
- * @param lifetime What to set.
- */
- public void setDefaultSecretExpirationPeriod(@NonNegative @Nonnull final Duration lifetime) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- Constraint.isFalse(lifetime == null || lifetime.isNegative(),
- "Default client secret expiration period must be greater than or equal to 0");
- defaultSecretExpirationPeriod = lifetime;
- }
/**
* Set the strategy used to locate the {@link OIDCClientRegistrationResponseContext} associated with a given
@@ -165,13 +147,14 @@ public class GenerateClientSecret extends AbstractProfileAction {
/** {@inheritDoc} */
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- final Duration lifetime = secretExpirationPeriodStrategy != null ?
+ Duration lifetime = secretExpirationPeriodStrategy != null ?
secretExpirationPeriodStrategy.apply(profileRequestContext) : null;
if (lifetime == null) {
log.debug("{} No secret expiration period supplied, using default", getLogPrefix());
+ lifetime = Duration.ofDays(365);
}
final Instant now = Instant.now();
- final Instant expiration = now.plus(lifetime != null ? lifetime : defaultSecretExpirationPeriod);
+ final Instant expiration = now.plus(lifetime);
final String clientSecret = idGenerator.generateIdentifier();
oidcResponseCtx.setClientSecret(clientSecret);
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/StoreClientInformation.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/StoreClientInformation.java
index 55145062..2076f5b3 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/StoreClientInformation.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/StoreClientInformation.java
@@ -40,7 +40,6 @@ import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCClientRegistratio
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.oidc.metadata.ClientInformationManager;
import net.shibboleth.oidc.metadata.ClientInformationManagerException;
-import net.shibboleth.utilities.java.support.annotation.constraint.NonNegative;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
@@ -61,9 +60,6 @@ public class StoreClientInformation extends AbstractProfileAction {
/** Strategy to obtain registration validity period policy. */
@Nullable private Function<ProfileRequestContext,Duration> registrationValidityPeriodStrategy;
- /** Default validity period for registration. */
- @Nullable @NonNegative private Duration defaultRegistrationValidityPeriod;
-
/** The response message. */
@Nullable private OIDCClientInformationResponse response;
@@ -76,7 +72,6 @@ public class StoreClientInformation extends AbstractProfileAction {
/** Constructor. */
public StoreClientInformation() {
oidcResponseContextLookupStrategy = new ChildContextLookup<>(OIDCClientRegistrationResponseContext.class);
- defaultRegistrationValidityPeriod = Duration.ofHours(24);
}
/**
@@ -91,20 +86,6 @@ public class StoreClientInformation extends AbstractProfileAction {
registrationValidityPeriodStrategy = strategy;
}
- /**
- * Set the default registration validity period in milliseconds.
- *
- * @param lifetime The default validity period in milliseconds.
- */
- public void setDefaultRegistrationValidityPeriod(@NonNegative @Nonnull final Duration lifetime) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- Constraint.isFalse(lifetime == null || lifetime.isNegative(),
- "Default registration validity period must be greater than or equal to 0");
-
- defaultRegistrationValidityPeriod = lifetime;
- }
-
/**
* Get the client information manager used for storing the information.
*
@@ -176,7 +157,7 @@ public class StoreClientInformation extends AbstractProfileAction {
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
final OIDCClientInformation clientInformation = response.getOIDCClientInformation();
- final Duration lifetime = registrationValidityPeriodStrategy != null ?
+ Duration lifetime = registrationValidityPeriodStrategy != null ?
registrationValidityPeriodStrategy.apply(profileRequestContext) : null;
try {
@@ -186,9 +167,9 @@ public class StoreClientInformation extends AbstractProfileAction {
} else {
if (lifetime == null) {
log.debug("{} No registration validity period supplied, using default", getLogPrefix());
+ lifetime = Duration.ofHours(24);
}
- final Instant expiration = Instant.now().plus(
- lifetime != null ? lifetime : defaultRegistrationValidityPeriod);
+ final Instant expiration = Instant.now().plus(lifetime);
log.debug("{} Registration will expire on {}", getLogPrefix(), expiration);
clientInformationManager.storeClientInformation(clientInformation, expiration);
}
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/register/register-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/register/register-beans.xml
index 057cb800..ce232e7b 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/register/register-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/register/register-beans.xml
@@ -39,8 +39,7 @@
scope="prototype" />
<bean id="GenerateClientSecret"
- class="net.shibboleth.idp.plugin.oidc.op.profile.impl.GenerateClientSecret" scope="prototype"
- p:defaultSecretExpirationPeriod="#{'%{idp.oidc.dynreg.defaultSecretExpiration:P12M}'.trim()}">
+ class="net.shibboleth.idp.plugin.oidc.op.profile.impl.GenerateClientSecret" scope="prototype">
<property name="secretExpirationPeriodStrategy">
<bean class="net.shibboleth.idp.plugin.oidc.op.config.navigate.SecretExpirationPeriodLookupFunction" />
</property>
@@ -129,13 +128,10 @@
p:storageService-ref="#{'%{idp.oidc.dynreg.StorageService:shibboleth.StorageService}'.trim()}" />
<bean id="StoreClientInformation"
- class="net.shibboleth.idp.plugin.oidc.op.profile.impl.StoreClientInformation"
- scope="prototype"
- p:clientInformationManager-ref="shibboleth.oidc.ClientInformationManager"
- p:defaultRegistrationValidityPeriod="#{'%{idp.oidc.dynreg.defaultRegistrationValidity:PT24H}'.trim()}">
+ class="net.shibboleth.idp.plugin.oidc.op.profile.impl.StoreClientInformation" scope="prototype"
+ p:clientInformationManager-ref="shibboleth.oidc.ClientInformationManager">
<property name="registrationValidityPeriodStrategy">
- <bean
- class="net.shibboleth.idp.plugin.oidc.op.config.navigate.RegistrationValidityPeriodLookupFunction" />
+ <bean class="net.shibboleth.idp.plugin.oidc.op.config.navigate.RegistrationValidityPeriodLookupFunction" />
</property>
</bean>
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index 4ca31774..8b7005e1 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -39,6 +39,8 @@
<bean id="OIDC.Registration" parent="AbstractOIDCProfile" lazy-init="true"
class="net.shibboleth.idp.plugin.oidc.op.config.OIDCDynamicRegistrationConfiguration"
p:issuer-ref="issuer"
+ p:registrationValidityPeriod="%{idp.oidc.dynreg.defaultRegistrationValidity:PT24H}"
+ p:secretExpirationPeriod="%{idp.oidc.dynreg.defaultSecretExpiration:P12M}"
p:tokenEndpointAuthMethods="%{idp.oidc.dynreg.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}" />
<bean id="OIDC.Configuration" parent="AbstractOIDCProfile" lazy-init="true"
@@ -244,10 +246,12 @@
</bean>
</property>
<property name="registrationValidityPeriodLookupStrategy">
- <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="registrationValidityPeriod" />
+ <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="registrationValidityPeriod"
+ p:defaultValue="%{idp.oidc.dynreg.defaultRegistrationValidity:PT24H}" />
</property>
<property name="secretExpirationPeriodLookupStrategy">
- <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="secretExpirationPeriod" />
+ <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="secretExpirationPeriod"
+ p:defaultValue="%{idp.oidc.dynreg.defaultSecretExpiration:P12M}" />
</property>
</bean>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list