[java-oidc-common] branch main updated: JOIDC-36 - Improvement suggestions for SAML metadata schema
Scott Cantor
cantor.2 at osu.edu
Wed Mar 3 23:40:03 UTC 2021
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=ca10e007ed87d75e1f9250f435153877642e148a
The following commit(s) were added to refs/heads/main by this push:
new ca10e00 JOIDC-36 - Improvement suggestions for SAML metadata schema
ca10e00 is described below
commit ca10e007ed87d75e1f9250f435153877642e148a
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Mar 3 18:40:01 2021 -0500
JOIDC-36 - Improvement suggestions for SAML metadata schema
https://issues.shibboleth.net/jira/browse/JOIDC-36
Replace invalid NameIDFormats with absolute URIs.
---
.../impl/ClientInformationNodeProcessor.java | 20 ++++++++++++++------
.../ext/impl/provider/InlineJwksProvider.java | 12 ++++++++++--
.../src/test/resources/logback-test.xml | 6 +++---
.../impl/EntitiesDescriptor-with-oidcmd-jwkdata.xml | 3 ++-
.../metadata/impl/EntitiesDescriptor-with-oidcmd.xml | 3 ++-
.../shibboleth/oidc/saml/xmlobject/Constants.java | 11 ++++++++++-
6 files changed, 41 insertions(+), 14 deletions(-)
diff --git a/oidc-common-metadata-impl/src/main/java/net/shibboleth/oidc/metadata/impl/ClientInformationNodeProcessor.java b/oidc-common-metadata-impl/src/main/java/net/shibboleth/oidc/metadata/impl/ClientInformationNodeProcessor.java
index c1a00e3..a5340a7 100644
--- a/oidc-common-metadata-impl/src/main/java/net/shibboleth/oidc/metadata/impl/ClientInformationNodeProcessor.java
+++ b/oidc-common-metadata-impl/src/main/java/net/shibboleth/oidc/metadata/impl/ClientInformationNodeProcessor.java
@@ -366,16 +366,24 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
protected @Nonnull SubjectType parseSubjectType(final @Nonnull SPSSODescriptor roleDescriptor) {
final List<NameIDFormat> nameIdFormats = roleDescriptor.getNameIDFormats();
if (nameIdFormats == null || nameIdFormats.isEmpty()) {
- log.warn("No NameIDFormat defined, using public");
+ log.warn("No NameIDFormat defined, using 'public'");
return SubjectType.PUBLIC;
}
if (nameIdFormats.size() > 1) {
- log.warn("Multiple NameIDFormats defined, using first one");
- }
- final String metadataValue = nameIdFormats.get(0).getURI();
- if (SubjectType.PAIRWISE.toString().equalsIgnoreCase(metadataValue)) {
- return SubjectType.PAIRWISE;
+ log.warn("Multiple NameIDFormats defined, using first one with a known value");
+ }
+
+ for (final NameIDFormat format : nameIdFormats) {
+ if (format != null) {
+ if (Constants.OIDC_SUB_NAMEID_FORMAT_PUBLIC.equals(format.getURI())) {
+ return SubjectType.PUBLIC;
+ } else if (Constants.OIDC_SUB_NAMEID_FORMAT_PAIRWISE.equals(format.getURI())) {
+ return SubjectType.PAIRWISE;
+ }
+ }
}
+
+ log.warn("No known NameIDFormats defined, using 'public'");
return SubjectType.PUBLIC;
}
diff --git a/oidc-common-metadata-impl/src/main/java/net/shibboleth/oidc/metadata/keyinfo/ext/impl/provider/InlineJwksProvider.java b/oidc-common-metadata-impl/src/main/java/net/shibboleth/oidc/metadata/keyinfo/ext/impl/provider/InlineJwksProvider.java
index 832c769..f8a1cbf 100644
--- a/oidc-common-metadata-impl/src/main/java/net/shibboleth/oidc/metadata/keyinfo/ext/impl/provider/InlineJwksProvider.java
+++ b/oidc-common-metadata-impl/src/main/java/net/shibboleth/oidc/metadata/keyinfo/ext/impl/provider/InlineJwksProvider.java
@@ -134,7 +134,11 @@ public class InlineJwksProvider extends AbstractKeyInfoProvider {
try {
return JWKSet.parse(input);
} catch (final ParseException e) {
- log.debug("Could not parse JWKSet from the given input", e);
+ if (log.isTraceEnabled()) {
+ log.trace("Could not parse JWKSet from the given input", e);
+ } else {
+ log.debug("Could not parse JWKSet from the given input: {}", e.getMessage());
+ }
}
return null;
}
@@ -143,7 +147,11 @@ public class InlineJwksProvider extends AbstractKeyInfoProvider {
try {
return JWK.parse(input);
} catch (final ParseException e) {
- log.debug("Could not parse JWK from the given input", e);
+ if (log.isTraceEnabled()) {
+ log.trace("Could not parse JWK from the given input", e);
+ } else {
+ log.debug("Could not parse JWK from the given input: {}", e.getMessage());
+ }
}
return null;
}
diff --git a/oidc-common-metadata-impl/src/test/resources/logback-test.xml b/oidc-common-metadata-impl/src/test/resources/logback-test.xml
index 552c933..0769b60 100644
--- a/oidc-common-metadata-impl/src/test/resources/logback-test.xml
+++ b/oidc-common-metadata-impl/src/test/resources/logback-test.xml
@@ -1,8 +1,8 @@
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
- <logger name="net.shibboleth.oidc" level="ALL"/>
- <logger name="org.springframework" level="DEBUG"/>
+ <logger name="net.shibboleth.oidc" level="DEBUG"/>
+ <logger name="org.springframework" level="INFO"/>
<appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
<encoder class="ch.qos.logback.classic.encoder.PatternLayoutEncoder">
@@ -12,7 +12,7 @@
</appender>
<root>
- <level value="DEBUG" />
+ <level value="INFO" />
<appender-ref ref="STDOUT" />
</root>
diff --git a/oidc-common-metadata-impl/src/test/resources/net/shibboleth/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd-jwkdata.xml b/oidc-common-metadata-impl/src/test/resources/net/shibboleth/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd-jwkdata.xml
index 519f716..4924911 100644
--- a/oidc-common-metadata-impl/src/test/resources/net/shibboleth/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd-jwkdata.xml
+++ b/oidc-common-metadata-impl/src/test/resources/net/shibboleth/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd-jwkdata.xml
@@ -116,7 +116,8 @@
<oidcmd:ClientSecret>mockClientSecretValue</oidcmd:ClientSecret>
</ds:KeyInfo>
</md:KeyDescriptor>
- <md:NameIDFormat>pairwise</md:NameIDFormat>
+ <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat>
+ <md:NameIDFormat>urn:mace:shibboleth:metadata:oidc:1.0:nameid-format:pairwise</md:NameIDFormat>
<md:AssertionConsumerService
Binding="https://tools.ietf.org/html/rfc6749#section-3.1.2"
Location="https://example.org/cb"
diff --git a/oidc-common-metadata-impl/src/test/resources/net/shibboleth/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd.xml b/oidc-common-metadata-impl/src/test/resources/net/shibboleth/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd.xml
index e4749b8..9083346 100644
--- a/oidc-common-metadata-impl/src/test/resources/net/shibboleth/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd.xml
+++ b/oidc-common-metadata-impl/src/test/resources/net/shibboleth/oidc/metadata/impl/EntitiesDescriptor-with-oidcmd.xml
@@ -108,7 +108,8 @@
<oidcmd:ClientSecret>mockClientSecretValue</oidcmd:ClientSecret>
</ds:KeyInfo>
</md:KeyDescriptor>
- <md:NameIDFormat>pairwise</md:NameIDFormat>
+ <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat>
+ <md:NameIDFormat>urn:mace:shibboleth:metadata:oidc:1.0:nameid-format:pairwise</md:NameIDFormat>
<md:AssertionConsumerService
Binding="https://tools.ietf.org/html/rfc6749#section-3.1.2"
Location="https://example.org/cb"
diff --git a/oidc-common-saml-api/src/main/java/net/shibboleth/oidc/saml/xmlobject/Constants.java b/oidc-common-saml-api/src/main/java/net/shibboleth/oidc/saml/xmlobject/Constants.java
index 566fae8..e932a0b 100644
--- a/oidc-common-saml-api/src/main/java/net/shibboleth/oidc/saml/xmlobject/Constants.java
+++ b/oidc-common-saml-api/src/main/java/net/shibboleth/oidc/saml/xmlobject/Constants.java
@@ -42,10 +42,19 @@ public final class Constants {
@Nonnull @NotEmpty public static final String OIDC_PROTOCOL_URI =
"http://openid.net/specs/openid-connect-core-1_0.html";
+ /** Format constant for signaling public "sub" claim in metadata. */
+ @Nonnull @NotEmpty public static final String OIDC_SUB_NAMEID_FORMAT_PUBLIC =
+ "urn:mace:shibboleth:metadata:oidc:1.0:nameid-format:public";
+
+ /** Format constant for signaling pairwise "sub" claim in metadata. */
+ @Nonnull @NotEmpty public static final String OIDC_SUB_NAMEID_FORMAT_PAIRWISE =
+ "urn:mace:shibboleth:metadata:oidc:1.0:nameid-format:pairwise";
+
/**
* Constructor.
*/
private Constants() {
// no op
}
-}
+
+}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list