[java-oidc-common] branch main updated: JOIDC-36 - Improvement suggestions for SAML metadata schema
Scott Cantor
cantor.2 at osu.edu
Wed Mar 3 20:33:36 UTC 2021
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=ab3fa36c9b8f34941d0ac2d83d2fcd06581e46d9
The following commit(s) were added to refs/heads/main by this push:
new ab3fa36 JOIDC-36 - Improvement suggestions for SAML metadata schema
ab3fa36 is described below
commit ab3fa36c9b8f34941d0ac2d83d2fcd06581e46d9
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Mar 3 15:33:34 2021 -0500
JOIDC-36 - Improvement suggestions for SAML metadata schema
https://issues.shibboleth.net/jira/browse/JOIDC-36
Initial round of fixes and improvements.
---
.../impl/ClientInformationNodeProcessor.java | 74 +++++++++++++-------
.../impl/ClientInformationNodeProcessorTest.java | 33 ++++++---
... => EntitiesDescriptor-with-oidcmd-jwkdata.xml} | 9 +--
.../impl/EntitiesDescriptor-with-oidcmd.xml | 17 +----
.../oidc/saml/xmlobject/OAuthRPExtensions.java | 14 ----
.../resources/schema/saml-metadata-ext-oidcmd.xsd | 80 ++++++++++++++--------
.../saml/xmlobject/impl/OAuthRPExtensionsImpl.java | 16 -----
.../impl/OAuthRPExtensionsUnmarshaller.java | 3 -
8 files changed, 122 insertions(+), 124 deletions(-)
diff --git a/oidc-common-metadata-impl/src/main/java/net/shibboleth/oidc/metadata/impl/ClientInformationNodeProcessor.java b/oidc-common-metadata-impl/src/main/java/net/shibboleth/oidc/metadata/impl/ClientInformationNodeProcessor.java
index eef15fd..c1a00e3 100644
--- a/oidc-common-metadata-impl/src/main/java/net/shibboleth/oidc/metadata/impl/ClientInformationNodeProcessor.java
+++ b/oidc-common-metadata-impl/src/main/java/net/shibboleth/oidc/metadata/impl/ClientInformationNodeProcessor.java
@@ -21,6 +21,7 @@ import java.net.URI;
import java.net.URISyntaxException;
import java.util.ArrayList;
import java.util.Arrays;
+import java.util.Collection;
import java.util.Collections;
import java.util.HashSet;
import java.util.List;
@@ -28,7 +29,6 @@ import java.util.Set;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
-import javax.xml.namespace.QName;
import org.opensaml.core.xml.XMLObject;
import org.opensaml.saml.criterion.RoleDescriptorCriterion;
@@ -72,8 +72,10 @@ import net.shibboleth.oidc.saml.xmlobject.Constants;
import net.shibboleth.oidc.saml.xmlobject.DefaultAcrValue;
import net.shibboleth.oidc.saml.xmlobject.MetadataValueSAMLObject;
import net.shibboleth.oidc.saml.xmlobject.OAuthRPExtensions;
+import net.shibboleth.oidc.security.credential.JWKReferenceCredential;
import net.shibboleth.oidc.security.credential.NimbusSecretCredential;
import net.shibboleth.oidc.security.impl.CredentialConversionUtil;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
@@ -182,7 +184,6 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
metadata.setIDTokenJWEEnc(parseEncryptionMethod(extensions.getIdTokenEncryptedResponseEnc()));
metadata.setIDTokenJWSAlg(parseJwsAlgorithm(extensions.getIdTokenSignedResponseAlg()));
metadata.setInitiateLoginURI(getSingleURIValue(extensions.getInitiateLoginUri()));
- metadata.setJWKSetURI(getSingleURIValue(extensions.getJwksUri()));
metadata.setPostLogoutRedirectionURIs(parseUris(extensions.getPostLogoutRedirectUris()));
metadata.setRedirectionURIs(parseRedirectUris(roleDescriptor));
metadata.setRequestObjectJWEAlg(parseJweAlgorithm(extensions.getRequestObjectEncryptionAlg()));
@@ -190,7 +191,7 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
metadata.setRequestObjectJWSAlg(parseJwsAlgorithm(extensions.getRequestObjectSigningAlg()));
metadata.setRequestObjectURIs(parseUris(extensions.getRequestUris()));
metadata.setResponseTypes(parseResponseTypes(extensions));
- metadata.setScope(parseScope(extensions));
+ metadata.setScope(parseScopes(extensions));
metadata.setSectorIDURI(getSingleURIValue(extensions.getSectorIdentifierUri()));
final String softwareId = getSingleValue(extensions.getSoftwareId());
if (softwareId != null) {
@@ -200,14 +201,20 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
if (softwareVersion != null) {
metadata.setSoftwareVersion(new SoftwareVersion(softwareVersion));
}
+ if (extensions.getDefaultMaxAge() > 0) {
+ metadata.setDefaultMaxAge(extensions.getDefaultMaxAge());
+ }
+ metadata.requiresAuthTime(extensions.isRequireAuthTime());
metadata.setSubjectType(parseSubjectType(roleDescriptor));
metadata.setTokenEndpointAuthMethod(parseClientAuthenticationMethod(extensions));
metadata.setTokenEndpointAuthJWSAlg(parseJwsAlgorithm(extensions.getTokenEndpointAuthSigningAlg()));
metadata.setUserInfoJWEAlg(parseJweAlgorithm(extensions.getUserInfoEncryptedResponseAlg()));
metadata.setUserInfoJWEEnc(parseEncryptionMethod(extensions.getUserInfoEncryptedResponseEnc()));
metadata.setUserInfoJWSAlg(parseJwsAlgorithm(extensions.getUserInfoSignedResponseAlg()));
- metadata.setJWKSet(parseJwkSet(credentials, clientId));
-
+ metadata.setJWKSetURI(parseJwkUri(credentials, clientId));
+ if (metadata.getJWKSetURI() == null) {
+ metadata.setJWKSet(parseJwkSet(credentials, clientId));
+ }
} else {
log.debug("No {} found to be processed", OAuthRPExtensions.TYPE_LOCAL_NAME);
}
@@ -298,26 +305,26 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
}
return jwks.isEmpty() ? null : new JWKSet(jwks);
}
-
+
/**
- * Get all objects of the given type from the given extensions.
+ * Convert the given credentials into a JWKS URI.
*
- * @param extension The extensions to get the object from.
- * @param type The type of the objects to get.
- * @return The list of objects of the given type.
+ * @param credentials The set to be converted.
+ * @param clientId The client ID related to the credentials.
+ * @return The given credentials converted into a JWKS URI
*/
- protected @Nonnull List<MetadataValueSAMLObject> getFromExtensions(final @Nonnull Extensions extension,
- final @Nonnull QName type) {
- final List<XMLObject> list = extension.getUnknownXMLObjects(type);
- final List<MetadataValueSAMLObject> result = new ArrayList<>();
- for (final XMLObject object : list) {
- if (object instanceof MetadataValueSAMLObject) {
- result.add((MetadataValueSAMLObject) object);
+ protected @Nullable URI parseJwkUri(final @Nonnull Iterable<Credential> credentials,
+ final @Nonnull String clientId) {
+ for (final Credential credential : credentials) {
+ if (credential instanceof JWKReferenceCredential) {
+ log.trace("Successfully located a JWKS URI for client {}: {}", clientId,
+ ((JWKReferenceCredential) credential).getReferenceURI());
+ return ((JWKReferenceCredential) credential).getReferenceURI();
}
}
- return result;
+ return null;
}
-
+
/**
* Parse the {@link ClientAuthenticationMethod} from the given extensions.
*
@@ -398,8 +405,8 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
protected @Nonnull Set<GrantType> parseGrantTypes(final @Nonnull OAuthRPExtensions extensions) {
final Set<GrantType> grantTypes = new HashSet<>();
for (final net.shibboleth.oidc.saml.xmlobject.GrantType grantType : extensions.getGrantTypes()) {
- final String value = getSingleValue(grantType);
- if (value != null) {
+ final Collection<String> values = getListValues(grantType);
+ for (final String value : values) {
grantTypes.add(new GrantType(value));
}
}
@@ -415,8 +422,8 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
protected @Nonnull Set<ResponseType> parseResponseTypes(final @Nonnull OAuthRPExtensions extensions) {
final Set<ResponseType> responseTypes = new HashSet<>();
for (final net.shibboleth.oidc.saml.xmlobject.ResponseType responseType : extensions.getResponseTypes()) {
- final String value = getSingleValue(responseType);
- if (value != null) {
+ final Collection<String> values = getListValues(responseType);
+ for (final String value : values) {
responseTypes.add(new ResponseType(value));
}
}
@@ -429,11 +436,11 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
* @param extensions The extensions to parse from.
* @return The scope that was found.
*/
- protected @Nonnull Scope parseScope(final @Nonnull OAuthRPExtensions extensions) {
+ protected @Nonnull Scope parseScopes(final @Nonnull OAuthRPExtensions extensions) {
final Scope scope = new Scope();
for (final net.shibboleth.oidc.saml.xmlobject.Scope singleScope : extensions.getScopes()) {
- final String value = getSingleValue(singleScope);
- if (value != null) {
+ final Collection<String> values = getListValues(singleScope);
+ for (final String value : values) {
scope.add(value);
}
}
@@ -532,6 +539,21 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
return null;
}
+ /**
+ * Parse an XML value list from a metadata value object into a collection of strings.
+ *
+ * @param metadataValue input object
+ *
+ * @return possibly empty value collection
+ */
+ @Nonnull @NonnullElements
+ protected Collection<String> getListValues(final @Nullable MetadataValueSAMLObject metadataValue) {
+ if (metadataValue != null) {
+ return StringSupport.stringToList(metadataValue.getValue(), " \t\n\r");
+ }
+ return Collections.emptyList();
+ }
+
/**
* Converts the metadata value object value into a {@link URI}.
*
diff --git a/oidc-common-metadata-impl/src/test/java/net/shibboleth/oidc/metadata/impl/ClientInformationNodeProcessorTest.java b/oidc-common-metadata-impl/src/test/java/net/shibboleth/oidc/metadata/impl/ClientInformationNodeProcessorTest.java
index 35c6c5b..8e2a837 100644
--- a/oidc-common-metadata-impl/src/test/java/net/shibboleth/oidc/metadata/impl/ClientInformationNodeProcessorTest.java
+++ b/oidc-common-metadata-impl/src/test/java/net/shibboleth/oidc/metadata/impl/ClientInformationNodeProcessorTest.java
@@ -53,7 +53,6 @@ import com.nimbusds.jose.JWEAlgorithm;
import com.nimbusds.jose.JWSAlgorithm;
import com.nimbusds.jose.jwk.JWKSet;
import com.nimbusds.oauth2.sdk.GrantType;
-import com.nimbusds.oauth2.sdk.ParseException;
import com.nimbusds.oauth2.sdk.ResponseType;
import com.nimbusds.oauth2.sdk.Scope;
import com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod;
@@ -64,7 +63,6 @@ import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
import net.shibboleth.ext.spring.resource.ResourceHelper;
-import net.shibboleth.oidc.metadata.impl.ClientInformationNodeProcessor;
import net.shibboleth.oidc.metadata.keyinfo.ext.impl.provider.ClientSecretProvider;
import net.shibboleth.oidc.metadata.keyinfo.ext.impl.provider.InlineJwksProvider;
import net.shibboleth.oidc.metadata.keyinfo.ext.impl.provider.JWKSReferenceProvider;
@@ -132,10 +130,20 @@ public class ClientInformationNodeProcessorTest extends XMLObjectBaseTestCase {
}
@Test
- public void testParsedXMLMetadata() throws ResolverException, ComponentInitializationException,
- URISyntaxException, ParseException, IOException {
+ public void testParsedXMLMetadataWithURI() throws Exception {
final RoleDescriptor role =
parseRoleDescriptor("/net/shibboleth/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd.xml");
+ validate(role, false);
+ }
+
+ @Test
+ public void testParsedXMLMetadataWithData() throws Exception {
+ final RoleDescriptor role =
+ parseRoleDescriptor("/net/shibboleth/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd-jwkdata.xml");
+ validate(role, true);
+ }
+
+ private void validate(final RoleDescriptor role, final boolean jwkdata) throws Exception {
Assert.assertNotNull(role);
Assert.assertTrue(role instanceof SPSSODescriptor);
final SPSSODescriptor sp = (SPSSODescriptor) role;
@@ -196,12 +204,16 @@ public class ClientInformationNodeProcessorTest extends XMLObjectBaseTestCase {
Assert.assertEquals(metadata.getUserInfoJWEEnc(), EncryptionMethod.A192GCM);
Assert.assertEquals(metadata.getUserInfoJWSAlg(), JWSAlgorithm.RS384);
- final JWKSet jwkSet = metadata.getJWKSet();
- Assert.assertEquals(jwkSet.getKeys().size(), 4);
- Assert.assertNotNull(jwkSet.getKeyByKeyId("mock"));
- Assert.assertNotNull(jwkSet.getKeyByKeyId("mockRSA"));
- Assert.assertNotNull(jwkSet.getKeyByKeyId("mockX509RSA"));
- Assert.assertNotNull(jwkSet.getKeyByKeyId("mockX509EC"));
+ if (jwkdata) {
+ final JWKSet jwkSet = metadata.getJWKSet();
+ Assert.assertEquals(jwkSet.getKeys().size(), 4);
+ Assert.assertNotNull(jwkSet.getKeyByKeyId("mock"));
+ Assert.assertNotNull(jwkSet.getKeyByKeyId("mockRSA"));
+ Assert.assertNotNull(jwkSet.getKeyByKeyId("mockX509RSA"));
+ Assert.assertNotNull(jwkSet.getKeyByKeyId("mockX509EC"));
+ } else {
+ Assert.assertEquals(metadata.getJWKSetURI(), new URI("https://example.org/jwks"));
+ }
final Set<URI> redirectUris = metadata.getRedirectionURIs();
Assert.assertEquals(redirectUris.size(), 2);
@@ -210,5 +222,4 @@ public class ClientInformationNodeProcessorTest extends XMLObjectBaseTestCase {
Assert.assertEquals(metadata.getSubjectType(), SubjectType.PAIRWISE);
}
-
}
diff --git a/oidc-common-metadata-impl/src/test/resources/net/shibboleth/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd.xml b/oidc-common-metadata-impl/src/test/resources/net/shibboleth/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd-jwkdata.xml
similarity index 95%
copy from oidc-common-metadata-impl/src/test/resources/net/shibboleth/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd.xml
copy to oidc-common-metadata-impl/src/test/resources/net/shibboleth/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd-jwkdata.xml
index 1e3195d..519f716 100644
--- a/oidc-common-metadata-impl/src/test/resources/net/shibboleth/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd.xml
+++ b/oidc-common-metadata-impl/src/test/resources/net/shibboleth/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd-jwkdata.xml
@@ -20,8 +20,7 @@
<oidcmd:RequestObjectEncryptionEnc>A128GCM</oidcmd:RequestObjectEncryptionEnc>
<oidcmd:RequestObjectSigningAlg>RS256</oidcmd:RequestObjectSigningAlg>
<oidcmd:RequestUri>https://example.org/request</oidcmd:RequestUri>
- <oidcmd:ResponseType>code</oidcmd:ResponseType>
- <oidcmd:ResponseType>id_token</oidcmd:ResponseType>
+ <oidcmd:ResponseType>code id_token</oidcmd:ResponseType>
<oidcmd:Scope>openid</oidcmd:Scope>
<oidcmd:Scope>profile</oidcmd:Scope>
<oidcmd:SoftwareId>mockSoftwareId</oidcmd:SoftwareId>
@@ -111,12 +110,6 @@
ekdQaVhDQkw0ZktEek5ZUXpIUSIKfQo=</oidcmd:JwksData>
</ds:KeyInfo>
</md:KeyDescriptor>
- <md:KeyDescriptor>
- <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
- <ds:KeyName>mockJwksUri</ds:KeyName>
- <oidcmd:JwksUri>https://example.org/jwks</oidcmd:JwksUri>
- </ds:KeyInfo>
- </md:KeyDescriptor>
<md:KeyDescriptor>
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:KeyName>mockClientSecret</ds:KeyName>
diff --git a/oidc-common-metadata-impl/src/test/resources/net/shibboleth/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd.xml b/oidc-common-metadata-impl/src/test/resources/net/shibboleth/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd.xml
index 1e3195d..e4749b8 100644
--- a/oidc-common-metadata-impl/src/test/resources/net/shibboleth/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd.xml
+++ b/oidc-common-metadata-impl/src/test/resources/net/shibboleth/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd.xml
@@ -20,8 +20,7 @@
<oidcmd:RequestObjectEncryptionEnc>A128GCM</oidcmd:RequestObjectEncryptionEnc>
<oidcmd:RequestObjectSigningAlg>RS256</oidcmd:RequestObjectSigningAlg>
<oidcmd:RequestUri>https://example.org/request</oidcmd:RequestUri>
- <oidcmd:ResponseType>code</oidcmd:ResponseType>
- <oidcmd:ResponseType>id_token</oidcmd:ResponseType>
+ <oidcmd:ResponseType>code id_token</oidcmd:ResponseType>
<oidcmd:Scope>openid</oidcmd:Scope>
<oidcmd:Scope>profile</oidcmd:Scope>
<oidcmd:SoftwareId>mockSoftwareId</oidcmd:SoftwareId>
@@ -97,20 +96,6 @@
</ds:KeyValue>
</ds:KeyInfo>
</md:KeyDescriptor>
- <md:KeyDescriptor use="signing">
- <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
- <ds:KeyName>mockJwkId</ds:KeyName>
- <oidcmd:JwksData>
- ewogICJrdHkiOiAiUlNBIiwKICAiZSI6ICJBUUFCIiwKICAia2lkIjogIm1vY2siLAogICJhbGci
- OiAiUlMyNTYiLAogICJuIjogInBKcHRScnpyRlhEUnBaWkdpRmc1eW9KeVRPMlphUENSNEcwbjEx
- aUVSclBTdlVYX202Qmdvak5qVEZISk1pa19pbGhtVzY0Q3JLdGlMdklRTFF6VWV5RXdDZHdYZVB3
- UVpNeEV4VDJPV2thQy1DV0ZJNHR4X2VFWGRkUGtja1NMRERhMEVQd3dzWktQUFhoRTNWNTBfZ3pW
- VDJZQVRvRE9fMmoyeGpWcHFzU0dFc0xpYjZqLW52dFpVVV9CMHNHeUppR1ZzMkpUTmhCTVNrT2tR
- Zks2NkNCcW1sbzBuUE5NYVIxbWl2dG5JUG1aNnJKVHcwUDVZZ0dFS1hmZjBsa25Ib25ZVmRsVktw
- c0Q4VW5hY0JzdFlyeUhsM0NQR2Uyc3RmR2ExZ3N6NEdIVGVfRnlWVk04UlNoQ2dYVVo3MTdoenpf
- ekdQaVhDQkw0ZktEek5ZUXpIUSIKfQo=</oidcmd:JwksData>
- </ds:KeyInfo>
- </md:KeyDescriptor>
<md:KeyDescriptor>
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:KeyName>mockJwksUri</ds:KeyName>
diff --git a/oidc-common-saml-api/src/main/java/net/shibboleth/oidc/saml/xmlobject/OAuthRPExtensions.java b/oidc-common-saml-api/src/main/java/net/shibboleth/oidc/saml/xmlobject/OAuthRPExtensions.java
index 7e1c728..da82ce8 100644
--- a/oidc-common-saml-api/src/main/java/net/shibboleth/oidc/saml/xmlobject/OAuthRPExtensions.java
+++ b/oidc-common-saml-api/src/main/java/net/shibboleth/oidc/saml/xmlobject/OAuthRPExtensions.java
@@ -106,20 +106,6 @@ public interface OAuthRPExtensions extends SAMLObject, AttributeExtensibleXMLObj
*/
public List<Scope> getScopes();
- /**
- * Get the URI for the JWK set.
- *
- * @return The URI for the JWK set.
- */
- public JwksUri getJwksUri();
-
- /**
- * Set the URI for the JWK set.
- *
- * @param uri The URI for the JWK set.
- */
- public void setJwksUri(final JwksUri uri);
-
/**
* Get the software identifier.
*
diff --git a/oidc-common-saml-api/src/main/resources/schema/saml-metadata-ext-oidcmd.xsd b/oidc-common-saml-api/src/main/resources/schema/saml-metadata-ext-oidcmd.xsd
index 8302a99..570cf06 100644
--- a/oidc-common-saml-api/src/main/resources/schema/saml-metadata-ext-oidcmd.xsd
+++ b/oidc-common-saml-api/src/main/resources/schema/saml-metadata-ext-oidcmd.xsd
@@ -7,6 +7,26 @@
</documentation>
</annotation>
+ <simpleType name="string">
+ <restriction base="string">
+ <minLength value="1"/>
+ </restriction>
+ </simpleType>
+
+ <simpleType name="anyURI">
+ <restriction base="anyURI">
+ <minLength value="1"/>
+ </restriction>
+ </simpleType>
+
+ <simpleType name="stringListType">
+ <list itemType="oidcmd:string"/>
+ </simpleType>
+
+ <simpleType name="anyURIListType">
+ <list itemType="oidcmd:anyURI"/>
+ </simpleType>
+
<element name="OAuthRPExtensions">
<complexType>
<choice minOccurs="0" maxOccurs="unbounded">
@@ -35,42 +55,42 @@
<element ref="oidcmd:PostLogoutRedirectUri" />
<any namespace="##other" processContents="lax" />
</choice>
- <attribute name="defaultMaxAge" type="int" use="optional" />
- <attribute name="requireAuthTime" type="string" use="optional" />
+ <attribute name="defaultMaxAge" type="int" />
+ <attribute name="requireAuthTime" type="boolean" />
<anyAttribute namespace="##other" processContents="lax" />
</complexType>
</element>
- <element name="TokenEndpointAuthMethod" type="anyURI" />
- <element name="GrantType" type="anyURI" />
- <element name="ResponseType" type="anyURI" />
- <element name="ApplicationType" type="anyURI" />
+ <element name="TokenEndpointAuthMethod" type="oidcmd:string" />
+ <element name="GrantType" type="oidcmd:stringListType" />
+ <element name="ResponseType" type="oidcmd:stringListType" />
+ <element name="ApplicationType" type="oidcmd:string" />
- <element name="ClientUri" type="anyURI" />
- <element name="Scope" type="anyURI" />
- <element name="SoftwareId" type="anyURI" />
- <element name="SoftwareVersion" type="anyURI" />
- <element name="SectorIdentifierUri" type="anyURI" />
+ <element name="ClientUri" type="oidcmd:anyURI" />
+ <element name="Scope" type="oidcmd:stringListType" />
+ <element name="SoftwareId" type="oidcmd:string" />
+ <element name="SoftwareVersion" type="oidcmd:string" />
+ <element name="SectorIdentifierUri" type="oidcmd:anyURI" />
- <element name="IdTokenSignedResponseAlg" type="anyURI" />
- <element name="IdTokenEncryptedResponseAlg" type="anyURI" />
- <element name="IdTokenEncryptedResponseEnc" type="anyURI" />
- <element name="UserInfoSignedResponseAlg" type="anyURI" />
- <element name="UserInfoEncryptedResponseAlg" type="anyURI" />
- <element name="UserInfoEncryptedResponseEnc" type="anyURI" />
- <element name="RequestObjectSigningAlg" type="anyURI" />
- <element name="RequestObjectEncryptionAlg" type="anyURI" />
- <element name="RequestObjectEncryptionEnc" type="anyURI" />
- <element name="TokenEndpointAuthSigningAlg" type="anyURI" />
- <element name="DefaultAcrValue" type="anyURI" />
- <element name="InitiateLoginUri" type="anyURI" />
- <element name="RequestUri" type="anyURI" />
- <element name="PostLogoutRedirectUri" type="anyURI" />
+ <element name="IdTokenSignedResponseAlg" type="oidcmd:string" />
+ <element name="IdTokenEncryptedResponseAlg" type="oidcmd:string" />
+ <element name="IdTokenEncryptedResponseEnc" type="oidcmd:string" />
+ <element name="UserInfoSignedResponseAlg" type="oidcmd:string" />
+ <element name="UserInfoEncryptedResponseAlg" type="oidcmd:string" />
+ <element name="UserInfoEncryptedResponseEnc" type="oidcmd:string" />
+ <element name="RequestObjectSigningAlg" type="oidcmd:string" />
+ <element name="RequestObjectEncryptionAlg" type="oidcmd:string" />
+ <element name="RequestObjectEncryptionEnc" type="oidcmd:string" />
+ <element name="TokenEndpointAuthSigningAlg" type="oidcmd:string" />
+
+ <element name="DefaultAcrValue" type="oidcmd:string" />
+ <element name="InitiateLoginUri" type="oidcmd:anyURI" />
+ <element name="RequestUri" type="oidcmd:anyURI" />
+ <element name="PostLogoutRedirectUri" type="oidcmd:anyURI" />
- <element name="JwkSet" type="anyURI" />
- <element name="JwkSetUri" type="anyURI" />
- <element name="JwksData" type="anyURI" />
- <element name="ClientSecret" type="anyURI" />
- <element name="ClientSecretKeyReference" type="anyURI" />
+ <element name="JwksUri" type="oidcmd:anyURI" />
+ <element name="JwksData" type="base64Binary" />
+ <element name="ClientSecret" type="oidcmd:string" />
+ <element name="ClientSecretKeyReference" type="oidcmd:string" />
</schema>
diff --git a/oidc-common-saml-impl/src/main/java/net/shibboleth/oidc/saml/xmlobject/impl/OAuthRPExtensionsImpl.java b/oidc-common-saml-impl/src/main/java/net/shibboleth/oidc/saml/xmlobject/impl/OAuthRPExtensionsImpl.java
index 40cdd54..01cf784 100644
--- a/oidc-common-saml-impl/src/main/java/net/shibboleth/oidc/saml/xmlobject/impl/OAuthRPExtensionsImpl.java
+++ b/oidc-common-saml-impl/src/main/java/net/shibboleth/oidc/saml/xmlobject/impl/OAuthRPExtensionsImpl.java
@@ -37,7 +37,6 @@ import net.shibboleth.oidc.saml.xmlobject.IdTokenEncryptedResponseAlg;
import net.shibboleth.oidc.saml.xmlobject.IdTokenEncryptedResponseEnc;
import net.shibboleth.oidc.saml.xmlobject.IdTokenSignedResponseAlg;
import net.shibboleth.oidc.saml.xmlobject.InitiateLoginUri;
-import net.shibboleth.oidc.saml.xmlobject.JwksUri;
import net.shibboleth.oidc.saml.xmlobject.OAuthRPExtensions;
import net.shibboleth.oidc.saml.xmlobject.PostLogoutRedirectUri;
import net.shibboleth.oidc.saml.xmlobject.RequestObjectEncryptionAlg;
@@ -78,9 +77,6 @@ public class OAuthRPExtensionsImpl extends AbstractXMLObject implements OAuthRPE
/** Scopes for this entity. */
private final XMLObjectChildrenList<Scope> scopes;
- /** JWKS URI for this entity. */
- private JwksUri jwksUri;
-
/** Software identifier for this entity. */
private SoftwareId softwareId;
@@ -218,18 +214,6 @@ public class OAuthRPExtensionsImpl extends AbstractXMLObject implements OAuthRPE
return scopes;
}
- /** {@inheritDoc} */
- @Override
- public JwksUri getJwksUri() {
- return jwksUri;
- }
-
- /** {@inheritDoc} */
- @Override
- public void setJwksUri(final JwksUri uri) {
- jwksUri = uri;
- }
-
/** {@inheritDoc} */
@Override
public SoftwareId getSoftwareId() {
diff --git a/oidc-common-saml-impl/src/main/java/net/shibboleth/oidc/saml/xmlobject/impl/OAuthRPExtensionsUnmarshaller.java b/oidc-common-saml-impl/src/main/java/net/shibboleth/oidc/saml/xmlobject/impl/OAuthRPExtensionsUnmarshaller.java
index 69816c6..99a59b2 100644
--- a/oidc-common-saml-impl/src/main/java/net/shibboleth/oidc/saml/xmlobject/impl/OAuthRPExtensionsUnmarshaller.java
+++ b/oidc-common-saml-impl/src/main/java/net/shibboleth/oidc/saml/xmlobject/impl/OAuthRPExtensionsUnmarshaller.java
@@ -32,7 +32,6 @@ import net.shibboleth.oidc.saml.xmlobject.IdTokenEncryptedResponseAlg;
import net.shibboleth.oidc.saml.xmlobject.IdTokenEncryptedResponseEnc;
import net.shibboleth.oidc.saml.xmlobject.IdTokenSignedResponseAlg;
import net.shibboleth.oidc.saml.xmlobject.InitiateLoginUri;
-import net.shibboleth.oidc.saml.xmlobject.JwksUri;
import net.shibboleth.oidc.saml.xmlobject.OAuthRPExtensions;
import net.shibboleth.oidc.saml.xmlobject.PostLogoutRedirectUri;
import net.shibboleth.oidc.saml.xmlobject.RequestObjectEncryptionAlg;
@@ -73,8 +72,6 @@ public class OAuthRPExtensionsUnmarshaller extends AbstractSAMLObjectUnmarshalle
descriptor.setClientUri((ClientUri) childSAMLObject);
} else if (childSAMLObject instanceof Scope) {
descriptor.getScopes().add((Scope) childSAMLObject);
- } else if (childSAMLObject instanceof JwksUri) {
- descriptor.setJwksUri((JwksUri) childSAMLObject);
} else if (childSAMLObject instanceof SoftwareId) {
descriptor.setSoftwareId((SoftwareId) childSAMLObject);
} else if (childSAMLObject instanceof SoftwareVersion) {
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list