[java-idp-oidc] 02/02: JOIDC-35 - Add missing audit fields

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=99557fde561ebf0c123944c00d98c778f5629a62

commit 99557fde561ebf0c123944c00d98c778f5629a62
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Mon Mar 15 15:45:10 2021 +0200

    JOIDC-35 - Add missing audit fields
    
    https://issues.shibboleth.net/jira/browse/JOIDC-35
    
    Set nonce (RS) field from authn request by default and from
    the id_token claims set on the token flow (which may issue id_token
    and doesn't have access to the authn request message).
---
 .../idp/flows/oidc/abstract/oidc-abstract-beans.xml    | 18 +++++++++---------
 .../shibboleth/idp/flows/oidc/token/token-beans.xml    | 17 +++++++++++++++++
 2 files changed, 26 insertions(+), 9 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml
index 232a61a1..b2236c03 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml
@@ -72,7 +72,7 @@
         p:fieldExtractors="#{getObject('shibboleth.oidc.PostLookupAuditExtractors') ?: getObject('shibboleth.DefaultPostLookupAuditExtractors')}" />
 
     <bean id="PostResponsePopulateAuditContext" parent="shibboleth.AbstractPopulateAuditContext"
-        p:fieldExtractors="#{getObject('shibboleth.oidc.PostResponseAuditExtractors') ?: getObject('shibboleth.oidc.DefaultPostResponseAuditExtractors')}" />
+        p:fieldExtractors="#{getObject('shibboleth.oidc.PostResponseAuditExtractors') ?: getObject('shibboleth.oidc.DefaultPostResponseAuditExtractorsForFlow') ?: getObject('shibboleth.oidc.DefaultPostResponseAuditExtractors')}" />
         
     <bean id="WriteAuditLog" class="net.shibboleth.idp.profile.audit.impl.WriteAuditLog" scope="prototype"
         p:formattingMap-ref="shibboleth.AuditFormattingMap"
@@ -128,6 +128,14 @@
                         </constructor-arg>
                     </bean>
                 </entry>
+                <entry>
+                    <key>
+                        <util:constant
+                            static-field="net.shibboleth.idp.plugin.oidc.op.audit.AuditFields.NONCE"/>
+                    </key>
+                    <bean class="net.shibboleth.idp.plugin.oidc.op.audit.impl.AuthenticationRequestClaimsAuditExtractor"
+                        c:claim="nonce" />
+                </entry>
             </map>
         </property>
     </bean>
@@ -178,14 +186,6 @@
                     <bean class="net.shibboleth.idp.plugin.oidc.op.audit.impl.IdTokenClaimsAuditExtractor"
                         c:claim="iat" />
                 </entry>
-                <entry>
-                    <key>
-                        <util:constant
-                            static-field="net.shibboleth.idp.plugin.oidc.op.audit.AuditFields.NONCE"/>
-                    </key>
-                    <bean class="net.shibboleth.idp.plugin.oidc.op.audit.impl.AuthenticationRequestClaimsAuditExtractor"
-                        c:claim="nonce" />
-                </entry>
                 <entry>
                     <key>
                         <util:constant static-field="net.shibboleth.idp.profile.IdPAuditFields.USERNAME"/>
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
index 095b56db..2e0c5b17 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
@@ -239,4 +239,21 @@
         p:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache" p:keyFetchInterval="%{idp.oidc.jwksuri.fetchInterval:PT30M}"
         p:parameterType="#{T(net.shibboleth.idp.plugin.oidc.op.security.impl.OIDCClientInformationSignatureValidationParametersResolver.ParameterType).TOKEN_ENDPOINT_JWT_VALIDATION}" />
 
+    <bean id="shibboleth.oidc.DefaultPostResponseAuditExtractorsForFlow"
+        parent="shibboleth.oidc.DefaultPostResponseAuditExtractors"
+        class="org.springframework.beans.factory.config.MapFactoryBean">
+        <property name="sourceMap">
+            <map merge="true">
+                <entry>
+                    <key>
+                        <util:constant
+                            static-field="net.shibboleth.idp.plugin.oidc.op.audit.AuditFields.NONCE"/>
+                    </key>
+                    <bean class="net.shibboleth.idp.plugin.oidc.op.audit.impl.IdTokenClaimsAuditExtractor"
+                        c:claim="nonce" />
+                </entry>
+            </map>
+        </property>
+    </bean>
+
 </beans>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.