[java-oidc-common] branch main updated: JOIDC-36 - Improvement suggestions for SAML metadata schema

Scott Cantor cantor.2 at osu.edu
Wed Mar 3 20:33:36 UTC 2021


This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=ab3fa36c9b8f34941d0ac2d83d2fcd06581e46d9

The following commit(s) were added to refs/heads/main by this push:
       new  ab3fa36   JOIDC-36 - Improvement suggestions for SAML metadata schema
ab3fa36 is described below

commit ab3fa36c9b8f34941d0ac2d83d2fcd06581e46d9
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Mar 3 15:33:34 2021 -0500

    JOIDC-36 - Improvement suggestions for SAML metadata schema
    
    https://issues.shibboleth.net/jira/browse/JOIDC-36
    
    Initial round of fixes and improvements.
---
 .../impl/ClientInformationNodeProcessor.java       | 74 +++++++++++++-------
 .../impl/ClientInformationNodeProcessorTest.java   | 33 ++++++---
 ... => EntitiesDescriptor-with-oidcmd-jwkdata.xml} |  9 +--
 .../impl/EntitiesDescriptor-with-oidcmd.xml        | 17 +----
 .../oidc/saml/xmlobject/OAuthRPExtensions.java     | 14 ----
 .../resources/schema/saml-metadata-ext-oidcmd.xsd  | 80 ++++++++++++++--------
 .../saml/xmlobject/impl/OAuthRPExtensionsImpl.java | 16 -----
 .../impl/OAuthRPExtensionsUnmarshaller.java        |  3 -
 8 files changed, 122 insertions(+), 124 deletions(-)

diff --git a/oidc-common-metadata-impl/src/main/java/net/shibboleth/oidc/metadata/impl/ClientInformationNodeProcessor.java b/oidc-common-metadata-impl/src/main/java/net/shibboleth/oidc/metadata/impl/ClientInformationNodeProcessor.java
index eef15fd..c1a00e3 100644
--- a/oidc-common-metadata-impl/src/main/java/net/shibboleth/oidc/metadata/impl/ClientInformationNodeProcessor.java
+++ b/oidc-common-metadata-impl/src/main/java/net/shibboleth/oidc/metadata/impl/ClientInformationNodeProcessor.java
@@ -21,6 +21,7 @@ import java.net.URI;
 import java.net.URISyntaxException;
 import java.util.ArrayList;
 import java.util.Arrays;
+import java.util.Collection;
 import java.util.Collections;
 import java.util.HashSet;
 import java.util.List;
@@ -28,7 +29,6 @@ import java.util.Set;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
-import javax.xml.namespace.QName;
 
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.saml.criterion.RoleDescriptorCriterion;
@@ -72,8 +72,10 @@ import net.shibboleth.oidc.saml.xmlobject.Constants;
 import net.shibboleth.oidc.saml.xmlobject.DefaultAcrValue;
 import net.shibboleth.oidc.saml.xmlobject.MetadataValueSAMLObject;
 import net.shibboleth.oidc.saml.xmlobject.OAuthRPExtensions;
+import net.shibboleth.oidc.security.credential.JWKReferenceCredential;
 import net.shibboleth.oidc.security.credential.NimbusSecretCredential;
 import net.shibboleth.oidc.security.impl.CredentialConversionUtil;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
 import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
 import net.shibboleth.utilities.java.support.primitive.StringSupport;
 import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
@@ -182,7 +184,6 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
             metadata.setIDTokenJWEEnc(parseEncryptionMethod(extensions.getIdTokenEncryptedResponseEnc()));
             metadata.setIDTokenJWSAlg(parseJwsAlgorithm(extensions.getIdTokenSignedResponseAlg()));
             metadata.setInitiateLoginURI(getSingleURIValue(extensions.getInitiateLoginUri()));
-            metadata.setJWKSetURI(getSingleURIValue(extensions.getJwksUri()));
             metadata.setPostLogoutRedirectionURIs(parseUris(extensions.getPostLogoutRedirectUris()));
             metadata.setRedirectionURIs(parseRedirectUris(roleDescriptor));
             metadata.setRequestObjectJWEAlg(parseJweAlgorithm(extensions.getRequestObjectEncryptionAlg()));
@@ -190,7 +191,7 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
             metadata.setRequestObjectJWSAlg(parseJwsAlgorithm(extensions.getRequestObjectSigningAlg()));
             metadata.setRequestObjectURIs(parseUris(extensions.getRequestUris()));
             metadata.setResponseTypes(parseResponseTypes(extensions));
-            metadata.setScope(parseScope(extensions));
+            metadata.setScope(parseScopes(extensions));
             metadata.setSectorIDURI(getSingleURIValue(extensions.getSectorIdentifierUri()));
             final String softwareId = getSingleValue(extensions.getSoftwareId());
             if (softwareId != null) {
@@ -200,14 +201,20 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
             if (softwareVersion != null) {
                 metadata.setSoftwareVersion(new SoftwareVersion(softwareVersion));
             }
+            if (extensions.getDefaultMaxAge() > 0) {
+                metadata.setDefaultMaxAge(extensions.getDefaultMaxAge());
+            }
+            metadata.requiresAuthTime(extensions.isRequireAuthTime());
             metadata.setSubjectType(parseSubjectType(roleDescriptor));
             metadata.setTokenEndpointAuthMethod(parseClientAuthenticationMethod(extensions));
             metadata.setTokenEndpointAuthJWSAlg(parseJwsAlgorithm(extensions.getTokenEndpointAuthSigningAlg()));
             metadata.setUserInfoJWEAlg(parseJweAlgorithm(extensions.getUserInfoEncryptedResponseAlg()));
             metadata.setUserInfoJWEEnc(parseEncryptionMethod(extensions.getUserInfoEncryptedResponseEnc()));
             metadata.setUserInfoJWSAlg(parseJwsAlgorithm(extensions.getUserInfoSignedResponseAlg()));
-            metadata.setJWKSet(parseJwkSet(credentials, clientId));
-           
+            metadata.setJWKSetURI(parseJwkUri(credentials, clientId));
+            if (metadata.getJWKSetURI() == null) {
+                metadata.setJWKSet(parseJwkSet(credentials, clientId));
+            }
         } else {
             log.debug("No {} found to be processed", OAuthRPExtensions.TYPE_LOCAL_NAME);
         }
@@ -298,26 +305,26 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
         }
         return jwks.isEmpty() ? null : new JWKSet(jwks);
     }
-    
+
     /**
-     * Get all objects of the given type from the given extensions.
+     * Convert the given credentials into a JWKS URI.
      * 
-     * @param extension The extensions to get the object from.
-     * @param type The type of the objects to get.
-     * @return The list of objects of the given type.
+     * @param credentials The set to be converted.
+     * @param clientId The client ID related to the credentials.
+     * @return The given credentials converted into a JWKS URI
      */
-    protected @Nonnull List<MetadataValueSAMLObject> getFromExtensions(final @Nonnull Extensions extension, 
-            final @Nonnull QName type) {
-        final List<XMLObject> list = extension.getUnknownXMLObjects(type);
-        final List<MetadataValueSAMLObject> result = new ArrayList<>();
-        for (final XMLObject object : list) {
-            if (object instanceof MetadataValueSAMLObject) {
-                result.add((MetadataValueSAMLObject) object);
+    protected @Nullable URI parseJwkUri(final @Nonnull Iterable<Credential> credentials, 
+            final @Nonnull String clientId) {
+        for (final Credential credential : credentials) {
+            if (credential instanceof JWKReferenceCredential) {
+                log.trace("Successfully located a JWKS URI for client {}: {}", clientId,
+                        ((JWKReferenceCredential) credential).getReferenceURI());
+                return ((JWKReferenceCredential) credential).getReferenceURI();
             }
         }
-        return result;
+        return null;
     }
-    
+
     /**
      * Parse the {@link ClientAuthenticationMethod} from the given extensions.
      * 
@@ -398,8 +405,8 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
     protected @Nonnull Set<GrantType> parseGrantTypes(final @Nonnull OAuthRPExtensions extensions) {
         final Set<GrantType> grantTypes = new HashSet<>();
         for (final net.shibboleth.oidc.saml.xmlobject.GrantType grantType : extensions.getGrantTypes()) {
-            final String value = getSingleValue(grantType);
-            if (value != null) {
+            final Collection<String> values = getListValues(grantType);
+            for (final String value : values) {
                 grantTypes.add(new GrantType(value));
             }
         }
@@ -415,8 +422,8 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
     protected @Nonnull Set<ResponseType> parseResponseTypes(final @Nonnull OAuthRPExtensions extensions) {
         final Set<ResponseType> responseTypes = new HashSet<>();
         for (final net.shibboleth.oidc.saml.xmlobject.ResponseType responseType : extensions.getResponseTypes()) {
-            final String value = getSingleValue(responseType);
-            if (value != null) {
+            final Collection<String> values = getListValues(responseType);
+            for (final String value : values) {
                 responseTypes.add(new ResponseType(value));
             }
         }
@@ -429,11 +436,11 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
      * @param extensions The extensions to parse from.
      * @return The scope that was found.
      */
-    protected @Nonnull Scope parseScope(final @Nonnull OAuthRPExtensions extensions) {
+    protected @Nonnull Scope parseScopes(final @Nonnull OAuthRPExtensions extensions) {
         final Scope scope = new Scope();
         for (final net.shibboleth.oidc.saml.xmlobject.Scope singleScope : extensions.getScopes()) {
-            final String value = getSingleValue(singleScope);
-            if (value != null) {
+            final Collection<String> values = getListValues(singleScope);
+            for (final String value : values) {
                 scope.add(value);
             }
         }
@@ -532,6 +539,21 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
         return null;
     }
     
+    /**
+     * Parse an XML value list from a metadata value object into a collection of strings.
+     * 
+     * @param metadataValue input object
+     * 
+     * @return possibly empty value collection
+     */
+    @Nonnull @NonnullElements
+    protected Collection<String> getListValues(final @Nullable MetadataValueSAMLObject metadataValue) {
+        if (metadataValue != null) {
+            return StringSupport.stringToList(metadataValue.getValue(), " \t\n\r");
+        }
+        return Collections.emptyList();
+    }
+    
     /**
      * Converts the metadata value object value into a {@link URI}.
      * 
diff --git a/oidc-common-metadata-impl/src/test/java/net/shibboleth/oidc/metadata/impl/ClientInformationNodeProcessorTest.java b/oidc-common-metadata-impl/src/test/java/net/shibboleth/oidc/metadata/impl/ClientInformationNodeProcessorTest.java
index 35c6c5b..8e2a837 100644
--- a/oidc-common-metadata-impl/src/test/java/net/shibboleth/oidc/metadata/impl/ClientInformationNodeProcessorTest.java
+++ b/oidc-common-metadata-impl/src/test/java/net/shibboleth/oidc/metadata/impl/ClientInformationNodeProcessorTest.java
@@ -53,7 +53,6 @@ import com.nimbusds.jose.JWEAlgorithm;
 import com.nimbusds.jose.JWSAlgorithm;
 import com.nimbusds.jose.jwk.JWKSet;
 import com.nimbusds.oauth2.sdk.GrantType;
-import com.nimbusds.oauth2.sdk.ParseException;
 import com.nimbusds.oauth2.sdk.ResponseType;
 import com.nimbusds.oauth2.sdk.Scope;
 import com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod;
@@ -64,7 +63,6 @@ import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
 import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
 
 import net.shibboleth.ext.spring.resource.ResourceHelper;
-import net.shibboleth.oidc.metadata.impl.ClientInformationNodeProcessor;
 import net.shibboleth.oidc.metadata.keyinfo.ext.impl.provider.ClientSecretProvider;
 import net.shibboleth.oidc.metadata.keyinfo.ext.impl.provider.InlineJwksProvider;
 import net.shibboleth.oidc.metadata.keyinfo.ext.impl.provider.JWKSReferenceProvider;
@@ -132,10 +130,20 @@ public class ClientInformationNodeProcessorTest extends XMLObjectBaseTestCase {
     }
     
     @Test
-    public void testParsedXMLMetadata() throws ResolverException, ComponentInitializationException,
-            URISyntaxException, ParseException, IOException {
+    public void testParsedXMLMetadataWithURI() throws Exception {
         final RoleDescriptor role = 
                 parseRoleDescriptor("/net/shibboleth/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd.xml");
+        validate(role, false);
+    }
+    
+    @Test
+    public void testParsedXMLMetadataWithData() throws Exception {
+        final RoleDescriptor role = 
+                parseRoleDescriptor("/net/shibboleth/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd-jwkdata.xml");
+        validate(role, true);
+    }
+
+    private void validate(final RoleDescriptor role, final boolean jwkdata) throws Exception {
         Assert.assertNotNull(role);
         Assert.assertTrue(role instanceof SPSSODescriptor);
         final SPSSODescriptor sp = (SPSSODescriptor) role;
@@ -196,12 +204,16 @@ public class ClientInformationNodeProcessorTest extends XMLObjectBaseTestCase {
         Assert.assertEquals(metadata.getUserInfoJWEEnc(), EncryptionMethod.A192GCM);
         Assert.assertEquals(metadata.getUserInfoJWSAlg(), JWSAlgorithm.RS384);
         
-        final JWKSet jwkSet = metadata.getJWKSet();
-        Assert.assertEquals(jwkSet.getKeys().size(), 4);
-        Assert.assertNotNull(jwkSet.getKeyByKeyId("mock"));
-        Assert.assertNotNull(jwkSet.getKeyByKeyId("mockRSA"));
-        Assert.assertNotNull(jwkSet.getKeyByKeyId("mockX509RSA"));
-        Assert.assertNotNull(jwkSet.getKeyByKeyId("mockX509EC"));
+        if (jwkdata) {
+            final JWKSet jwkSet = metadata.getJWKSet();
+            Assert.assertEquals(jwkSet.getKeys().size(), 4);
+            Assert.assertNotNull(jwkSet.getKeyByKeyId("mock"));
+            Assert.assertNotNull(jwkSet.getKeyByKeyId("mockRSA"));
+            Assert.assertNotNull(jwkSet.getKeyByKeyId("mockX509RSA"));
+            Assert.assertNotNull(jwkSet.getKeyByKeyId("mockX509EC"));
+        } else {
+            Assert.assertEquals(metadata.getJWKSetURI(), new URI("https://example.org/jwks"));
+        }
         
         final Set<URI> redirectUris = metadata.getRedirectionURIs();
         Assert.assertEquals(redirectUris.size(), 2);
@@ -210,5 +222,4 @@ public class ClientInformationNodeProcessorTest extends XMLObjectBaseTestCase {
         
         Assert.assertEquals(metadata.getSubjectType(), SubjectType.PAIRWISE);
     }
-    
 }
diff --git a/oidc-common-metadata-impl/src/test/resources/net/shibboleth/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd.xml b/oidc-common-metadata-impl/src/test/resources/net/shibboleth/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd-jwkdata.xml
similarity index 95%
copy from oidc-common-metadata-impl/src/test/resources/net/shibboleth/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd.xml
copy to oidc-common-metadata-impl/src/test/resources/net/shibboleth/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd-jwkdata.xml
index 1e3195d..519f716 100644
--- a/oidc-common-metadata-impl/src/test/resources/net/shibboleth/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd.xml
+++ b/oidc-common-metadata-impl/src/test/resources/net/shibboleth/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd-jwkdata.xml
@@ -20,8 +20,7 @@
                     <oidcmd:RequestObjectEncryptionEnc>A128GCM</oidcmd:RequestObjectEncryptionEnc>
                     <oidcmd:RequestObjectSigningAlg>RS256</oidcmd:RequestObjectSigningAlg>
                     <oidcmd:RequestUri>https://example.org/request</oidcmd:RequestUri>
-                    <oidcmd:ResponseType>code</oidcmd:ResponseType>
-                    <oidcmd:ResponseType>id_token</oidcmd:ResponseType>
+                    <oidcmd:ResponseType>code id_token</oidcmd:ResponseType>
                     <oidcmd:Scope>openid</oidcmd:Scope>
                     <oidcmd:Scope>profile</oidcmd:Scope>
                     <oidcmd:SoftwareId>mockSoftwareId</oidcmd:SoftwareId>
@@ -111,12 +110,6 @@
                         ekdQaVhDQkw0ZktEek5ZUXpIUSIKfQo=</oidcmd:JwksData>
                 </ds:KeyInfo>
             </md:KeyDescriptor>
-            <md:KeyDescriptor>
-                <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
-                    <ds:KeyName>mockJwksUri</ds:KeyName>
-                    <oidcmd:JwksUri>https://example.org/jwks</oidcmd:JwksUri>
-                </ds:KeyInfo>
-            </md:KeyDescriptor>
             <md:KeyDescriptor>
                 <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                     <ds:KeyName>mockClientSecret</ds:KeyName>
diff --git a/oidc-common-metadata-impl/src/test/resources/net/shibboleth/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd.xml b/oidc-common-metadata-impl/src/test/resources/net/shibboleth/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd.xml
index 1e3195d..e4749b8 100644
--- a/oidc-common-metadata-impl/src/test/resources/net/shibboleth/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd.xml
+++ b/oidc-common-metadata-impl/src/test/resources/net/shibboleth/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd.xml
@@ -20,8 +20,7 @@
                     <oidcmd:RequestObjectEncryptionEnc>A128GCM</oidcmd:RequestObjectEncryptionEnc>
                     <oidcmd:RequestObjectSigningAlg>RS256</oidcmd:RequestObjectSigningAlg>
                     <oidcmd:RequestUri>https://example.org/request</oidcmd:RequestUri>
-                    <oidcmd:ResponseType>code</oidcmd:ResponseType>
-                    <oidcmd:ResponseType>id_token</oidcmd:ResponseType>
+                    <oidcmd:ResponseType>code id_token</oidcmd:ResponseType>
                     <oidcmd:Scope>openid</oidcmd:Scope>
                     <oidcmd:Scope>profile</oidcmd:Scope>
                     <oidcmd:SoftwareId>mockSoftwareId</oidcmd:SoftwareId>
@@ -97,20 +96,6 @@
                     </ds:KeyValue>
                 </ds:KeyInfo>
             </md:KeyDescriptor>
-            <md:KeyDescriptor use="signing">
-                <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
-                    <ds:KeyName>mockJwkId</ds:KeyName>
-                    <oidcmd:JwksData>
-                        ewogICJrdHkiOiAiUlNBIiwKICAiZSI6ICJBUUFCIiwKICAia2lkIjogIm1vY2siLAogICJhbGci
-                        OiAiUlMyNTYiLAogICJuIjogInBKcHRScnpyRlhEUnBaWkdpRmc1eW9KeVRPMlphUENSNEcwbjEx
-                        aUVSclBTdlVYX202Qmdvak5qVEZISk1pa19pbGhtVzY0Q3JLdGlMdklRTFF6VWV5RXdDZHdYZVB3
-                        UVpNeEV4VDJPV2thQy1DV0ZJNHR4X2VFWGRkUGtja1NMRERhMEVQd3dzWktQUFhoRTNWNTBfZ3pW
-                        VDJZQVRvRE9fMmoyeGpWcHFzU0dFc0xpYjZqLW52dFpVVV9CMHNHeUppR1ZzMkpUTmhCTVNrT2tR
-                        Zks2NkNCcW1sbzBuUE5NYVIxbWl2dG5JUG1aNnJKVHcwUDVZZ0dFS1hmZjBsa25Ib25ZVmRsVktw
-                        c0Q4VW5hY0JzdFlyeUhsM0NQR2Uyc3RmR2ExZ3N6NEdIVGVfRnlWVk04UlNoQ2dYVVo3MTdoenpf
-                        ekdQaVhDQkw0ZktEek5ZUXpIUSIKfQo=</oidcmd:JwksData>
-                </ds:KeyInfo>
-            </md:KeyDescriptor>
             <md:KeyDescriptor>
                 <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                     <ds:KeyName>mockJwksUri</ds:KeyName>
diff --git a/oidc-common-saml-api/src/main/java/net/shibboleth/oidc/saml/xmlobject/OAuthRPExtensions.java b/oidc-common-saml-api/src/main/java/net/shibboleth/oidc/saml/xmlobject/OAuthRPExtensions.java
index 7e1c728..da82ce8 100644
--- a/oidc-common-saml-api/src/main/java/net/shibboleth/oidc/saml/xmlobject/OAuthRPExtensions.java
+++ b/oidc-common-saml-api/src/main/java/net/shibboleth/oidc/saml/xmlobject/OAuthRPExtensions.java
@@ -106,20 +106,6 @@ public interface OAuthRPExtensions extends SAMLObject, AttributeExtensibleXMLObj
      */
     public List<Scope> getScopes();
     
-    /**
-     * Get the URI for the JWK set.
-     * 
-     * @return The URI for the JWK set.
-     */
-    public JwksUri getJwksUri();
-    
-    /**
-     * Set the URI for the JWK set.
-     * 
-     * @param uri The URI for the JWK set.
-     */
-    public void setJwksUri(final JwksUri uri);
-    
     /**
      * Get the software identifier.
      * 
diff --git a/oidc-common-saml-api/src/main/resources/schema/saml-metadata-ext-oidcmd.xsd b/oidc-common-saml-api/src/main/resources/schema/saml-metadata-ext-oidcmd.xsd
index 8302a99..570cf06 100644
--- a/oidc-common-saml-api/src/main/resources/schema/saml-metadata-ext-oidcmd.xsd
+++ b/oidc-common-saml-api/src/main/resources/schema/saml-metadata-ext-oidcmd.xsd
@@ -7,6 +7,26 @@
         </documentation>
     </annotation>
 
+    <simpleType name="string">
+        <restriction base="string">
+            <minLength value="1"/>
+        </restriction>
+    </simpleType>
+
+    <simpleType name="anyURI">
+        <restriction base="anyURI">
+            <minLength value="1"/>
+        </restriction>
+    </simpleType>
+
+    <simpleType name="stringListType">
+        <list itemType="oidcmd:string"/>
+    </simpleType>
+
+    <simpleType name="anyURIListType">
+        <list itemType="oidcmd:anyURI"/>
+    </simpleType>
+
     <element name="OAuthRPExtensions">
         <complexType>
             <choice minOccurs="0" maxOccurs="unbounded">
@@ -35,42 +55,42 @@
                 <element ref="oidcmd:PostLogoutRedirectUri" />
                 <any namespace="##other" processContents="lax" />
             </choice>
-            <attribute name="defaultMaxAge" type="int" use="optional" />
-            <attribute name="requireAuthTime" type="string" use="optional" />
+            <attribute name="defaultMaxAge" type="int" />
+            <attribute name="requireAuthTime" type="boolean" />
             <anyAttribute namespace="##other" processContents="lax" />
         </complexType>
     </element>
 
-    <element name="TokenEndpointAuthMethod" type="anyURI" />
-    <element name="GrantType" type="anyURI" />
-    <element name="ResponseType" type="anyURI" />
-    <element name="ApplicationType" type="anyURI" />
+    <element name="TokenEndpointAuthMethod" type="oidcmd:string" />
+    <element name="GrantType" type="oidcmd:stringListType" />
+    <element name="ResponseType" type="oidcmd:stringListType" />
+    <element name="ApplicationType" type="oidcmd:string" />
 
-    <element name="ClientUri" type="anyURI" />
-    <element name="Scope" type="anyURI" />
-    <element name="SoftwareId" type="anyURI" />
-    <element name="SoftwareVersion" type="anyURI" />
-    <element name="SectorIdentifierUri" type="anyURI" />
+    <element name="ClientUri" type="oidcmd:anyURI" />
+    <element name="Scope" type="oidcmd:stringListType" />
+    <element name="SoftwareId" type="oidcmd:string" />
+    <element name="SoftwareVersion" type="oidcmd:string" />
+    <element name="SectorIdentifierUri" type="oidcmd:anyURI" />
 
-    <element name="IdTokenSignedResponseAlg" type="anyURI" />
-    <element name="IdTokenEncryptedResponseAlg" type="anyURI" />
-    <element name="IdTokenEncryptedResponseEnc" type="anyURI" />
-    <element name="UserInfoSignedResponseAlg" type="anyURI" />
-    <element name="UserInfoEncryptedResponseAlg" type="anyURI" />
-    <element name="UserInfoEncryptedResponseEnc" type="anyURI" />
-    <element name="RequestObjectSigningAlg" type="anyURI" />
-    <element name="RequestObjectEncryptionAlg" type="anyURI" />
-    <element name="RequestObjectEncryptionEnc" type="anyURI" />
-    <element name="TokenEndpointAuthSigningAlg" type="anyURI" />
-    <element name="DefaultAcrValue" type="anyURI" />
-    <element name="InitiateLoginUri" type="anyURI" />
-    <element name="RequestUri" type="anyURI" />
-    <element name="PostLogoutRedirectUri" type="anyURI" />
+    <element name="IdTokenSignedResponseAlg" type="oidcmd:string" />
+    <element name="IdTokenEncryptedResponseAlg" type="oidcmd:string" />
+    <element name="IdTokenEncryptedResponseEnc" type="oidcmd:string" />
+    <element name="UserInfoSignedResponseAlg" type="oidcmd:string" />
+    <element name="UserInfoEncryptedResponseAlg" type="oidcmd:string" />
+    <element name="UserInfoEncryptedResponseEnc" type="oidcmd:string" />
+    <element name="RequestObjectSigningAlg" type="oidcmd:string" />
+    <element name="RequestObjectEncryptionAlg" type="oidcmd:string" />
+    <element name="RequestObjectEncryptionEnc" type="oidcmd:string" />
+    <element name="TokenEndpointAuthSigningAlg" type="oidcmd:string" />
+    
+    <element name="DefaultAcrValue" type="oidcmd:string" />
+    <element name="InitiateLoginUri" type="oidcmd:anyURI" />
+    <element name="RequestUri" type="oidcmd:anyURI" />
+    <element name="PostLogoutRedirectUri" type="oidcmd:anyURI" />
     
-    <element name="JwkSet" type="anyURI" />
-    <element name="JwkSetUri" type="anyURI" />
-    <element name="JwksData" type="anyURI" />
-    <element name="ClientSecret" type="anyURI" />
-    <element name="ClientSecretKeyReference" type="anyURI" />
+    <element name="JwksUri" type="oidcmd:anyURI" />
+    <element name="JwksData" type="base64Binary" />
+    <element name="ClientSecret" type="oidcmd:string" />
+    <element name="ClientSecretKeyReference" type="oidcmd:string" />
 
 </schema>
diff --git a/oidc-common-saml-impl/src/main/java/net/shibboleth/oidc/saml/xmlobject/impl/OAuthRPExtensionsImpl.java b/oidc-common-saml-impl/src/main/java/net/shibboleth/oidc/saml/xmlobject/impl/OAuthRPExtensionsImpl.java
index 40cdd54..01cf784 100644
--- a/oidc-common-saml-impl/src/main/java/net/shibboleth/oidc/saml/xmlobject/impl/OAuthRPExtensionsImpl.java
+++ b/oidc-common-saml-impl/src/main/java/net/shibboleth/oidc/saml/xmlobject/impl/OAuthRPExtensionsImpl.java
@@ -37,7 +37,6 @@ import net.shibboleth.oidc.saml.xmlobject.IdTokenEncryptedResponseAlg;
 import net.shibboleth.oidc.saml.xmlobject.IdTokenEncryptedResponseEnc;
 import net.shibboleth.oidc.saml.xmlobject.IdTokenSignedResponseAlg;
 import net.shibboleth.oidc.saml.xmlobject.InitiateLoginUri;
-import net.shibboleth.oidc.saml.xmlobject.JwksUri;
 import net.shibboleth.oidc.saml.xmlobject.OAuthRPExtensions;
 import net.shibboleth.oidc.saml.xmlobject.PostLogoutRedirectUri;
 import net.shibboleth.oidc.saml.xmlobject.RequestObjectEncryptionAlg;
@@ -78,9 +77,6 @@ public class OAuthRPExtensionsImpl extends AbstractXMLObject implements OAuthRPE
     /** Scopes for this entity. */
     private final XMLObjectChildrenList<Scope> scopes;
     
-    /** JWKS URI for this entity. */
-    private JwksUri jwksUri;
-    
     /** Software identifier for this entity. */
     private SoftwareId softwareId;
     
@@ -218,18 +214,6 @@ public class OAuthRPExtensionsImpl extends AbstractXMLObject implements OAuthRPE
         return scopes;
     }
 
-    /** {@inheritDoc} */
-    @Override
-    public JwksUri getJwksUri() {
-        return jwksUri;
-    }
-
-    /** {@inheritDoc} */
-    @Override
-    public void setJwksUri(final JwksUri uri) {
-        jwksUri = uri;
-    }
-
     /** {@inheritDoc} */
     @Override
     public SoftwareId getSoftwareId() {
diff --git a/oidc-common-saml-impl/src/main/java/net/shibboleth/oidc/saml/xmlobject/impl/OAuthRPExtensionsUnmarshaller.java b/oidc-common-saml-impl/src/main/java/net/shibboleth/oidc/saml/xmlobject/impl/OAuthRPExtensionsUnmarshaller.java
index 69816c6..99a59b2 100644
--- a/oidc-common-saml-impl/src/main/java/net/shibboleth/oidc/saml/xmlobject/impl/OAuthRPExtensionsUnmarshaller.java
+++ b/oidc-common-saml-impl/src/main/java/net/shibboleth/oidc/saml/xmlobject/impl/OAuthRPExtensionsUnmarshaller.java
@@ -32,7 +32,6 @@ import net.shibboleth.oidc.saml.xmlobject.IdTokenEncryptedResponseAlg;
 import net.shibboleth.oidc.saml.xmlobject.IdTokenEncryptedResponseEnc;
 import net.shibboleth.oidc.saml.xmlobject.IdTokenSignedResponseAlg;
 import net.shibboleth.oidc.saml.xmlobject.InitiateLoginUri;
-import net.shibboleth.oidc.saml.xmlobject.JwksUri;
 import net.shibboleth.oidc.saml.xmlobject.OAuthRPExtensions;
 import net.shibboleth.oidc.saml.xmlobject.PostLogoutRedirectUri;
 import net.shibboleth.oidc.saml.xmlobject.RequestObjectEncryptionAlg;
@@ -73,8 +72,6 @@ public class OAuthRPExtensionsUnmarshaller extends AbstractSAMLObjectUnmarshalle
             descriptor.setClientUri((ClientUri) childSAMLObject);
         } else if (childSAMLObject instanceof Scope) {
             descriptor.getScopes().add((Scope) childSAMLObject);
-        } else if (childSAMLObject instanceof JwksUri) {
-            descriptor.setJwksUri((JwksUri) childSAMLObject);
         } else if (childSAMLObject instanceof SoftwareId) {
             descriptor.setSoftwareId((SoftwareId) childSAMLObject);
         } else if (childSAMLObject instanceof SoftwareVersion) {

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the commits mailing list