[java-idp-oidc] 01/02: Added a new configuration property 'idp.oidc.dynreg.validateRemoteJwks'

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=e9b2f44f6e8093d349f02b6660ca6da6b426072d

commit e9b2f44f6e8093d349f02b6660ca6da6b426072d
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Sat Mar 20 19:12:28 2021 +0200

    Added a new configuration property 'idp.oidc.dynreg.validateRemoteJwks'
    
    Defaults to true, exploited by dynamic client registration (action AddJwksToClientMetadata).
---
 .../op/profile/impl/AddJwksToClientMetadata.java   | 37 ++++++++++++++++++----
 .../idp/flows/oidc/register/register-beans.xml     |  3 +-
 .../idp/plugin/oidc/op/conf/oidc.properties        |  2 ++
 3 files changed, 34 insertions(+), 8 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddJwksToClientMetadata.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddJwksToClientMetadata.java
index 4aee73d9..6f808b0b 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddJwksToClientMetadata.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddJwksToClientMetadata.java
@@ -19,6 +19,7 @@ package net.shibboleth.idp.plugin.oidc.op.profile.impl;
 
 import java.net.URI;
 import java.util.List;
+import java.util.function.Predicate;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
@@ -31,6 +32,7 @@ import org.opensaml.security.httpclient.HttpClientSecurityParameters;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import com.google.common.base.Predicates;
 import com.nimbusds.jose.jwk.JWK;
 import com.nimbusds.jose.jwk.JWKSet;
 
@@ -56,6 +58,9 @@ public class AddJwksToClientMetadata extends AbstractOIDCClientMetadataPopulatio
     /** HTTP client security parameters. */
     @Nullable private HttpClientSecurityParameters httpClientSecurityParameters;
     
+    /** Predicate used to indicate whether contents of remote JWK set should be validated. */
+    @Nonnull private Predicate<ProfileRequestContext> validateRemoteJwkSetPredicate;
+    
     /**
      * Constructor.
      */
@@ -73,6 +78,7 @@ public class AddJwksToClientMetadata extends AbstractOIDCClientMetadataPopulatio
         ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
 
         httpClient = Constraint.isNotNull(client, "HttpClient cannot be null");
+        validateRemoteJwkSetPredicate = Predicates.alwaysTrue();
     }
 
     /**
@@ -86,7 +92,19 @@ public class AddJwksToClientMetadata extends AbstractOIDCClientMetadataPopulatio
 
         httpClientSecurityParameters = params;
     }
+    
+    /**
+     * Set the predicate used to indicate whether contents of remote JWK set should be validated.
+     *
+     * @param predicate the predicate used to indicate whether contents of remote JWK set should be validated.
+     */
+    public void setValidateRemoteJwkSetPredicate(@Nonnull final Predicate<ProfileRequestContext> predicate) {
+        ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+        ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
 
+        validateRemoteJwkSetPredicate = Constraint.isNotNull(predicate, "Predicate cannot be null");
+    }
+    
     /** {@inheritDoc} */
     public void doInitialize() throws ComponentInitializationException {
         super.doInitialize();
@@ -119,14 +137,19 @@ public class AddJwksToClientMetadata extends AbstractOIDCClientMetadataPopulatio
         }
         
         if (jwkUri != null) {
-            final JWKSet remoteSet = RemoteJwkUtils.fetchRemoteJwkSet(getLogPrefix(), jwkUri, httpClient, 
-                    httpClientSecurityParameters);
-            if (containsKeys(remoteSet)) {
-                log.debug("{} The jwks_uri endpoint available and contains key(s)", getLogPrefix());
-                getOutputMetadata().setJWKSetURI(jwkUri);
+            if (validateRemoteJwkSetPredicate.test(profileRequestContext)) {
+                final JWKSet remoteSet = RemoteJwkUtils.fetchRemoteJwkSet(getLogPrefix(), jwkUri, httpClient, 
+                        httpClientSecurityParameters);
+                if (containsKeys(remoteSet)) {
+                    log.debug("{} The jwks_uri endpoint available and contains key(s)", getLogPrefix());
+                    getOutputMetadata().setJWKSetURI(jwkUri);
+                } else {
+                    log.warn("{} The jwks_uri was defined, but the endpoint does not contain key(s)", getLogPrefix());
+                    ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
+                }
             } else {
-                log.warn("{} The jwks_uri was defined, but the endpoint does not contain key(s)", getLogPrefix());
-                ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);                
+                log.debug("{} The jwks_uri endpoint added to metadata without validation", getLogPrefix());
+                getOutputMetadata().setJWKSetURI(jwkUri);
             }
             return;
         }
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/register/register-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/register/register-beans.xml
index ce232e7b..e13bbe7f 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/register/register-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/register/register-beans.xml
@@ -96,7 +96,8 @@
         class="net.shibboleth.idp.plugin.oidc.op.profile.impl.AddJwksToClientMetadata"
         scope="prototype"
         p:httpClient="#{getObject('shibboleth.oidc.NonBrowser.HttpClient') ?: getObject('shibboleth.InternalHttpClient')}"
-        p:httpClientSecurityParameters="#{getObject('shibboleth.oidc.NonBrowser.HttpClientSecurityParameters')}" />
+        p:httpClientSecurityParameters="#{getObject('shibboleth.oidc.NonBrowser.HttpClientSecurityParameters')}"
+        p:validateRemoteJwkSetPredicate-ref="%{idp.oidc.dynreg.validateRemoteJwks:shibboleth.Conditions.TRUE}"/>
 
     <bean id="AddLogoUrisToClientMetadata"
         class="net.shibboleth.idp.plugin.oidc.op.profile.impl.AddLogoUrisToClientMetadata"
diff --git a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
index aa9368c6..9d70b74c 100644
--- a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
+++ b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
@@ -14,6 +14,8 @@ idp.oidc.issuer = https://your.issuer.example.org
 #idp.oidc.dynreg.tokenEndpointAuthMethods = client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt
 # Regardless of what signing algorithms are configured, allow none for request object signing
 #idp.oidc.dynreg.allowNoneForRequestSigning = true
+# Bean to determine whether dynamic registration should validate the remote JWK set if it's defined in the request
+#idp.oidc.dynreg.validateRemoteJwks = shibboleth.Conditions.TRUE
 
 # Storage for storing remote jwk sets.
 #idp.oidc.jwk.StorageService = shibboleth.StorageService

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.