[java-idp-plugin-oidc-rp] branch main updated: Add basic, unfinished, profile configuration support
Phil Smart
philip.smart at jisc.ac.uk
Fri Nov 26 15:55:18 UTC 2021
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=79632560ba1d0b79096aad0080824ce1dc92d140
The following commit(s) were added to refs/heads/main by this push:
new 7963256 Add basic, unfinished, profile configuration support
7963256 is described below
commit 79632560ba1d0b79096aad0080824ce1dc92d140
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Nov 26 15:55:12 2021 +0000
Add basic, unfinished, profile configuration support
Also stub an AddAuthzRequest action.
---
.../context/OIDCAuthorizationRequestContext.java | 11 ++
.../context/OIDCProviderMetadataContext.java | 46 ++++++++
idp-oidc-rp-impl/pom.xml | 7 +-
.../plugin/authn/oidc/rp/impl/AddAuthzRequest.java | 64 +++++++++++
...OutboundAuthorizationRequestMessageContext.java | 108 ++++++++++++++++++
.../rp/impl/InitializeRelyingPartyContext.java | 122 +++++++++++++++++++++
.../impl/OIDCProviderMetadataLookupHandler.java | 20 ++--
.../META-INF/net.shibboleth.idp/postconfig.xml | 68 ++++++++++--
.../oidc-relying-party-authn-beans.xml | 23 +++-
.../oidc-relying-party-authn-flow.xml | 11 +-
.../authn/providermetadata-resolver-system.xml | 3 +-
.../plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java | 16 ++-
.../resources/conf/test-relying-party-system.xml | 50 +++++++++
.../conf/test-relyingparty-resolver-service.xml | 49 +++++++++
14 files changed, 564 insertions(+), 34 deletions(-)
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/OIDCAuthorizationRequestContext.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/OIDCAuthorizationRequestContext.java
new file mode 100644
index 0000000..a768639
--- /dev/null
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/OIDCAuthorizationRequestContext.java
@@ -0,0 +1,11 @@
+package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context;
+
+import org.opensaml.messaging.context.BaseContext;
+
+/**
+ * Subcontext carrying information to form an authorization request for an OpenID Connect Provider. This context
+ * appears as a subcontext of the {@link org.opensaml.messaging.context.MessageContext}.
+ */
+public class OIDCAuthorizationRequestContext extends BaseContext {
+
+}
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/OIDCProviderMetadataContext.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/OIDCProviderMetadataContext.java
new file mode 100644
index 0000000..118c312
--- /dev/null
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/OIDCProviderMetadataContext.java
@@ -0,0 +1,46 @@
+package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+import javax.annotation.concurrent.ThreadSafe;
+
+import org.opensaml.messaging.context.BaseContext;
+
+import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
+
+import net.shibboleth.utilities.java.support.logic.Constraint;
+
+/**
+ * Subcontext carrying information on metadata of the openid provider. This
+ * context appears as a subcontext of the
+ * {@link org.opensaml.messaging.context.MessageContext} that carries the actual
+ * OIDC request message, in such cases the metadata carried herein applies to
+ * the issuer of that message.
+ */
+ at ThreadSafe
+public class OIDCProviderMetadataContext extends BaseContext {
+
+ /** The client information. */
+ @Nonnull private final OIDCProviderMetadata providerInformation;
+
+ /**
+ *
+ * Constructor.
+ *
+ * @param metadata the provider configuration information.
+ */
+ public OIDCProviderMetadataContext(@Nonnull final OIDCProviderMetadata metadata) {
+ providerInformation = Constraint.isNotNull(metadata, "OIDC Provider Metadata can not be null");
+ }
+
+ /**
+ * Set the client information.
+ *
+ * @return The client information.
+ */
+ @Nullable
+ public OIDCProviderMetadata getProviderInformation() {
+ return providerInformation;
+ }
+
+}
\ No newline at end of file
diff --git a/idp-oidc-rp-impl/pom.xml b/idp-oidc-rp-impl/pom.xml
index 55f433a..019f384 100644
--- a/idp-oidc-rp-impl/pom.xml
+++ b/idp-oidc-rp-impl/pom.xml
@@ -76,13 +76,18 @@
<artifactId>oidc-common-metadata-api</artifactId>
<scope>provided</scope>
</dependency>
+ <dependency>
+ <groupId>net.shibboleth.oidc</groupId>
+ <artifactId>oidc-common-profile-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
<dependency>
<groupId>javax.servlet</groupId>
<artifactId>javax.servlet-api</artifactId>
<scope>provided</scope>
</dependency>
<!-- Tmp OP deps until things move to commons -->
- <!-- <dependency>
+ <!-- <dependency>
<groupId>net.shibboleth.idp.plugin.oidc</groupId>
<artifactId>idp-plugin-oidc-op-api</artifactId>
</dependency>
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddAuthzRequest.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddAuthzRequest.java
new file mode 100644
index 0000000..d82cb36
--- /dev/null
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddAuthzRequest.java
@@ -0,0 +1,64 @@
+package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.messaging.context.navigate.ParentContextLookup;
+import org.opensaml.profile.action.ActionSupport;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import net.shibboleth.idp.authn.AbstractAuthenticationAction;
+import net.shibboleth.idp.authn.context.AuthenticationContext;
+import net.shibboleth.idp.profile.IdPEventIds;
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.idp.saml.saml2.profile.config.BrowserSSOProfileConfiguration;
+
+public class AddAuthzRequest extends AbstractAuthenticationAction {
+
+ /** Class logger. */
+ @Nonnull private Logger log = LoggerFactory.getLogger(AddAuthzRequest.class);
+
+ /** Applicable profile configuration. */
+ //TODO not currently used - needs profile implementation actions to work
+ @Nullable private BrowserSSOProfileConfiguration profileConfiguration;
+
+ /** Constructor.*/
+ public AddAuthzRequest() {
+ // Fool the parent class into looking above instead of below the PRC for the context.
+ setAuthenticationContextLookupStrategy(new ParentContextLookup<>(AuthenticationContext.class));
+ }
+
+ @Override
+ protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext,
+ @Nonnull final AuthenticationContext authenticationContext) {
+
+ if (!super.doPreExecute(profileRequestContext, authenticationContext)) {
+ return false;
+ }
+
+ final RelyingPartyContext rpCtx = profileRequestContext.getSubcontext(RelyingPartyContext.class);
+ if (rpCtx != null && rpCtx.getConfiguration() != null &&
+ rpCtx.getProfileConfig() instanceof BrowserSSOProfileConfiguration) {
+ profileConfiguration = (BrowserSSOProfileConfiguration) rpCtx.getProfileConfig();
+ }
+ if (profileConfiguration == null) {
+ log.error("{} BrowserSSOProfileConfiguration not found", getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_PROFILE_CONFIG);
+ return false;
+ }
+
+ return true;
+ }
+
+ @Override
+ protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext,
+ @Nonnull final AuthenticationContext authenticationContext) {
+
+ log.debug("{} Building AuthzRequest for upstream OP ({})",
+ getLogPrefix(), authenticationContext.getAuthenticatingAuthority());
+
+ }
+
+}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOutboundAuthorizationRequestMessageContext.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOutboundAuthorizationRequestMessageContext.java
new file mode 100644
index 0000000..ee7ac0a
--- /dev/null
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOutboundAuthorizationRequestMessageContext.java
@@ -0,0 +1,108 @@
+package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
+
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.messaging.context.MessageContext;
+import org.opensaml.messaging.context.navigate.ChildContextLookup;
+import org.opensaml.profile.action.ActionSupport;
+import org.opensaml.profile.action.EventIds;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.OIDCAuthorizationRequestContext;
+import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.OIDCProviderMetadataContext;
+import net.shibboleth.idp.profile.AbstractProfileAction;
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.utilities.java.support.component.ComponentSupport;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+
+
+public class InitializeOutboundAuthorizationRequestMessageContext extends AbstractProfileAction {
+
+ /** Class logger. */
+ @Nonnull
+ private final Logger log = LoggerFactory.getLogger(InitializeOutboundAuthorizationRequestMessageContext.class);
+
+ /** Strategy function to lookup the {@link OIDCMetadataContext}. */
+ @Nonnull private Function<ProfileRequestContext, OIDCProviderMetadataContext> oidcProviderMetadataCtxLookupStrategy;
+
+ /**
+ * Strategy used to locate the {@link RelyingPartyContext} associated with a given {@link ProfileRequestContext}.
+ */
+ @Nonnull private Function<ProfileRequestContext, RelyingPartyContext> relyingPartyCtxLookupStrategy;
+
+ /** The relying party context used for storing the SAML metadata context. */
+ //TODO do we need this one? or just the OIDC provider metadata context?
+ private RelyingPartyContext relyingPartyCtx;
+
+ /**
+ * Constructor.
+ */
+ public InitializeOutboundAuthorizationRequestMessageContext() {
+ oidcProviderMetadataCtxLookupStrategy = new ChildContextLookup<>(OIDCProviderMetadataContext.class).compose(
+ new InboundMessageContextLookup());
+ relyingPartyCtxLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
+ }
+
+ /**
+ * Set the strategy to lookup the {@link oidcProviderMetadataCtxLookupStrategy} from the {@link ProfileRequestContext}.
+ *
+ * @param strgy What to set.
+ */
+ public void setOIDCProviderMetadataContextLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext, OIDCProviderMetadataContext> strgy) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ oidcProviderMetadataCtxLookupStrategy = Constraint.isNotNull(strgy, "Injected Metadata Strategy cannot be null");
+ }
+
+ /**
+ * Set the strategy used to locate the {@link RelyingPartyContext} associated with a given
+ * {@link ProfileRequestContext}.
+ *
+ * @param strategy strategy used to locate the {@link RelyingPartyContext} associated with a given
+ * {@link ProfileRequestContext}
+ */
+ public void setRelyingPartyContextLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext, RelyingPartyContext> strategy) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ relyingPartyCtxLookupStrategy =
+ Constraint.isNotNull(strategy, "RelyingPartyContext lookup strategy cannot be null");
+ }
+
+ @Override
+ protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+
+ if (!super.doPreExecute(profileRequestContext)) {
+ return false;
+ }
+
+ relyingPartyCtx = relyingPartyCtxLookupStrategy.apply(profileRequestContext);
+ if (relyingPartyCtx == null) {
+ log.error("{} No relying party context", getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
+ return false;
+ }
+
+ return true;
+
+ }
+
+ @Override
+ protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+ super.doExecute(profileRequestContext);
+
+ final MessageContext msgCtx = new MessageContext();
+ profileRequestContext.setOutboundMessageContext(msgCtx);
+ msgCtx.addSubcontext(new OIDCAuthorizationRequestContext());
+ log.debug("{} Initialized outbound message context", getLogPrefix());
+
+
+ }
+
+}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeRelyingPartyContext.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeRelyingPartyContext.java
new file mode 100644
index 0000000..a2544b6
--- /dev/null
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeRelyingPartyContext.java
@@ -0,0 +1,122 @@
+package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
+
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.messaging.context.MessageContext;
+import org.opensaml.messaging.context.navigate.ChildContextLookup;
+import org.opensaml.profile.action.ActionSupport;
+import org.opensaml.profile.action.EventIds;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.OIDCProviderMetadataContext;
+import net.shibboleth.idp.plugin.authn.oidc.rp.metadata.impl.DefaultIssuerIDLookupFunction;
+import net.shibboleth.idp.profile.AbstractProfileAction;
+import net.shibboleth.idp.profile.IdPEventIds;
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.utilities.java.support.component.ComponentSupport;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+
+public class InitializeRelyingPartyContext extends AbstractProfileAction {
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(InitializeRelyingPartyContext.class);
+
+ /** Strategy that will return or create a {@link RelyingPartyContext}. */
+ @Nonnull private Function<ProfileRequestContext, RelyingPartyContext> relyingPartyContextCreationStrategy;
+
+ /** Strategy that will return {@link OIDCMetadataContext}. */
+ @Nonnull private Function<ProfileRequestContext, OIDCProviderMetadataContext> oidcProviderMetadataContextLookupStrategy;
+
+ /** Strategy used to obtain the client id value for authorize/token request. */
+ @Nonnull private Function<MessageContext, String> issuerIDLookupStrategy;
+
+ /** OIDC issuer id of the downstream OP. */
+ @Nullable private String issuerId;
+
+ /** Constructor. */
+ public InitializeRelyingPartyContext() {
+ relyingPartyContextCreationStrategy = new ChildContextLookup<>(RelyingPartyContext.class, true);
+ oidcProviderMetadataContextLookupStrategy = new ChildContextLookup<>(OIDCProviderMetadataContext.class).compose(
+ new InboundMessageContextLookup());
+ issuerIDLookupStrategy = new DefaultIssuerIDLookupFunction();
+ }
+
+ /**
+ * Set the strategy used to locate the issuer id of the request.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setIssuerIDLookupStrategy(@Nonnull final Function<MessageContext, String> strategy) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+ issuerIDLookupStrategy =
+ Constraint.isNotNull(strategy, "IssuerID lookup strategy cannot be null");
+ }
+
+ /**
+ * Set the strategy used to return or create the {@link RelyingPartyContext} .
+ *
+ * @param strategy creation strategy
+ */
+ public void setRelyingPartyContextCreationStrategy(
+ @Nonnull final Function<ProfileRequestContext, RelyingPartyContext> strategy) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ relyingPartyContextCreationStrategy =
+ Constraint.isNotNull(strategy, "RelyingPartyContext creation strategy cannot be null");
+ }
+
+ /**
+ * Set the strategy used to return the {@link OIDCProviderMetadataContext}.
+ *
+ * @param strategy The lookup strategy.
+ */
+ public void setOidcProviderMetadataContextLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext, OIDCProviderMetadataContext> strategy) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ oidcProviderMetadataContextLookupStrategy =
+ Constraint.isNotNull(strategy, "OIDCMetadataContext lookup strategy cannot be null");
+ }
+
+ @Override
+ protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+ if (!super.doPreExecute(profileRequestContext)) {
+ log.error("{} pre-execute failed", getLogPrefix());
+ return false;
+ }
+ issuerId = issuerIDLookupStrategy.apply(profileRequestContext.getInboundMessageContext());
+ if (issuerId == null) {
+ log.error("{} Unable to locate issuer id from the request", getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
+ return false;
+ }
+ return true;
+ }
+
+ @Override
+ protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+
+ final RelyingPartyContext rpContext = relyingPartyContextCreationStrategy.apply(profileRequestContext);
+ if (rpContext == null) {
+ log.error("{} Unable to locate or create RelyingPartyContext", getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_RELYING_PARTY_CTX);
+ return;
+ }
+ log.debug("Attaching RelyingPartyContext for OP {}", issuerId);
+ rpContext.setRelyingPartyId(issuerId);
+ final OIDCProviderMetadataContext oidcContext = oidcProviderMetadataContextLookupStrategy.apply(profileRequestContext);
+ //TODO is this sufficient to set verified to true? Yes as a verified reyling party if metadata attached
+ if (oidcContext != null && oidcContext.getProviderInformation() != null
+ && issuerId.equals(oidcContext.getProviderInformation().getIssuer().getValue())) {
+ log.debug("{} Setting the OP context to 'verified'", getLogPrefix());
+ rpContext.setVerified(true);
+ }
+ }
+
+}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/metadata/impl/OIDCProviderMetadataLookupHandler.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/metadata/impl/OIDCProviderMetadataLookupHandler.java
index ef3c1fe..42f78d8 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/metadata/impl/OIDCProviderMetadataLookupHandler.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/metadata/impl/OIDCProviderMetadataLookupHandler.java
@@ -13,6 +13,7 @@ import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.id.Issuer;
import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
+import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.OIDCProviderMetadataContext;
import net.shibboleth.oidc.metadata.ProviderMetadataResolver;
import net.shibboleth.oidc.metadata.criterion.IssuerIDCriterion;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
@@ -37,15 +38,9 @@ public class OIDCProviderMetadataLookupHandler extends AbstractMessageHandler {
@NonnullAfterInit private ProviderMetadataResolver providerResolver;
/** Strategy used to obtain the issuer id value for the inbound message context. */
- @Nonnull private Function<MessageContext,String> issuerIDLookupStrategy;
-
- /**
- * Constructor.
- */
- public OIDCProviderMetadataLookupHandler() {
- //issuerIDLookupStrategy = new DefaultIssuerIDLookupFunction();
- }
+ @NonnullAfterInit private Function<MessageContext,String> issuerIDLookupStrategy;
+
/**
* Set the strategy used to locate the client id of the request.
*
@@ -76,10 +71,13 @@ public class OIDCProviderMetadataLookupHandler extends AbstractMessageHandler {
if (providerResolver == null) {
throw new ComponentInitializationException("IssuerMetadataResolver cannot be null");
}
+ if (issuerIDLookupStrategy == null) {
+ throw new ComponentInitializationException("IssuerIDLookupStrategy cannot be null");
+ }
}
@Override
- protected void doInvoke(MessageContext messageContext) throws MessageHandlerException {
+ protected void doInvoke(final MessageContext messageContext) throws MessageHandlerException {
ComponentSupport.ifNotInitializedThrowUninitializedComponentException(this);
// Resolve issuer id from inbound message
@@ -95,9 +93,7 @@ public class OIDCProviderMetadataLookupHandler extends AbstractMessageHandler {
return;
}
log.debug("{} Found provider metadata for '{}'", getLogPrefix(), issuerId);
-// final OIDCMetadataContext oidcCtx = new OIDCMetadataContext();
-// oidcCtx.setClientInformation(clientInformation);
-// messageContext.addSubcontext(oidcCtx);
+ messageContext.addSubcontext(new OIDCProviderMetadataContext(issuerMetadata));
} catch (final ResolverException e) {
log.error("{} ResolverException thrown during provider metadata lookup", getLogPrefix(), e);
}
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 883d26d..a7d633b 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -16,17 +16,17 @@
-->
<bean id="authn/OIDCRelyingParty" parent="shibboleth.AuthenticationFlow"
- p:order="%{idp.authn.OIDC.RP.order:1000}"
- p:nonBrowserSupported="%{idp.authn.OIDC.RP.nonBrowserSupported:true}"
- p:passiveAuthenticationSupported="%{idp.authn.OIDC.RP.passiveAuthenticationSupported:true}"
- p:forcedAuthenticationSupported="%{idp.authn.OIDC.RP.forcedAuthenticationSupported:true}"
- p:proxyRestrictionsEnforced="%{idp.authn.OIDC.RP.proxyRestrictionsEnforced:%{idp.authn.enforceProxyRestrictions:true}}"
- p:proxyScopingEnforced="%{idp.authn.OIDC.RP.proxyScopingEnforced:false}"
- p:discoveryRequired="%{idp.authn.OIDC.RP.discoveryRequired:false}"
- p:lifetime="%{idp.authn.OIDC.RP.lifetime:%{idp.authn.defaultLifetime:PT1H}}"
- p:inactivityTimeout="%{idp.authn.OIDC.RP.inactivityTimeout:%{idp.authn.defaultTimeout:PT30M}}"
- p:reuseCondition-ref="#{'%{idp.authn.OIDC.RP.reuseCondition:shibboleth.Conditions.TRUE}'.trim()}"
- p:activationCondition-ref="#{'%{idp.authn.OIDC.RP.activationCondition:shibboleth.Conditions.TRUE}'.trim()}">
+ p:order="%{idp.authn.oidc.rp.order:1000}"
+ p:nonBrowserSupported="%{idp.authn.oidc.rp.nonBrowserSupported:true}"
+ p:passiveAuthenticationSupported="%{idp.authn.oidc.rp.passiveAuthenticationSupported:true}"
+ p:forcedAuthenticationSupported="%{idp.authn.oidc.rp.forcedAuthenticationSupported:true}"
+ p:proxyRestrictionsEnforced="%{idp.authn.oidc.rp.proxyRestrictionsEnforced:%{idp.authn.enforceProxyRestrictions:true}}"
+ p:proxyScopingEnforced="%{idp.authn.oidc.rp.proxyScopingEnforced:false}"
+ p:discoveryRequired="%{idp.authn.oidc.rp.discoveryRequired:false}"
+ p:lifetime="%{idp.authn.oidc.rp.lifetime:%{idp.authn.defaultLifetime:PT1H}}"
+ p:inactivityTimeout="%{idp.authn.oidc.rp.inactivityTimeout:%{idp.authn.defaultTimeout:PT30M}}"
+ p:reuseCondition-ref="#{'%{idp.authn.oidc.rp.reuseCondition:shibboleth.Conditions.TRUE}'.trim()}"
+ p:activationCondition-ref="#{'%{idp.authn.oidc.rp.activationCondition:shibboleth.Conditions.TRUE}'.trim()}">
<property name="supportedPrincipals">
<list>
<bean parent="shibboleth.SAML2AuthnContextClassRef"
@@ -37,10 +37,54 @@
</property>
<property name="supportedPrincipalsByString">
<bean parent="shibboleth.CommaDelimStringArray"
- c:_0="#{'%{idp.authn.OIDC.RP.supportedPrincipals:}'.trim()}" />
+ c:_0="#{'%{idp.authn.oidc.rp.supportedPrincipals:}'.trim()}" />
</property>
</bean>
+
+ <bean id="issuer" class="java.lang.String" c:_0="%{idp.authn.oidc.rp.issuer:%{idp.entityID}}" />
+
+ <bean id="AbstractOIDCProfile" abstract="true"
+ p:securityConfiguration-ref="%{idp.security.authn.oidc.rp.config:shibboleth.oidc.DefaultSecurityConfiguration}" />
+
+ <bean id="OIDC.SSO" parent="AbstractOIDCProfile" lazy-init="true"
+ class="net.shibboleth.oidc.profile.config.OIDCCoreProtocolConfiguration"
+ p:issuer-ref="issuer"
+ p:iDTokenLifetime="%{idp.authn.oidc.rp.idToken.defaultLifetime:PT1H}"
+ p:accessTokenLifetime="%{idp.authn.oidc.rp.accessToken.defaultLifetime:PT10M}"
+ p:authorizeCodeLifetime="%{idp.authn.oidc.rp.authorizeCode.defaultLifetime:PT5M}"
+ p:refreshTokenLifetime="%{idp.authn.oidc.rp.refreshToken.defaultLifetime:PT2H}"
+ p:tokenEndpointAuthMethods="%{idp.authn.oidc.rp.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}"
+ p:forcePKCE="%{idp.authn.oidc.rp.forcePKCE:false}"
+ p:allowPKCEPlain="%{idp.authn.oidc.rp.allowPKCEPlain:false}"
+ p:encodeConsentInTokens="%{idp.authn.oidc.rp.encodeConsentInTokens:false}"
+ p:encodedAttributes="%{idp.authn.oidc.rp.encodedAttributes:%{idp.oidc.embeddedAttributes:}}"
+ p:alwaysIncludedAttributes="%{idp.authn.oidc.rp.alwaysIncludedAttributes:}"
+ p:deniedUserInfoAttributes="%{idp.authn.oidc.rp.deniedUserInfoAttributes:}" />
+ <!--
+ Security Configuration Defaults. These settings establish the default security
+ configurations for signatures and loads the default credentials used.
+ -->
+
+ <bean id="shibboleth.oidc.DefaultSecurityConfiguration"
+ class="net.shibboleth.oidc.profile.config.OIDCSecurityConfiguration">
+ <!-- Add these back were appropriate -->
+ <!-- <property name="signatureSigningConfiguration">
+ <ref bean="#{'%{idp.oidc.signing.config:shibboleth.oidc.SigningConfiguration}'.trim()}" />
+ </property>
+ <property name="encryptionConfiguration">
+ <ref bean="#{'%{idp.oidc.encryption.config:shibboleth.oidc.EncryptionConfiguration}'.trim()}" />
+ </property>
+ <property name="requestObjectDecryptionConfiguration">
+ <ref bean="#{'%{idp.oidc.rodecrypt.config:shibboleth.oidc.requestObjectDecryptionConfiguration}'.trim()}" />
+ </property>
+ <property name="requestObjectSignatureValidationConfiguration">
+ <ref bean="#{'%{idp.oidc.rovalid.config:shibboleth.oidc.requestObjectSignatureValidationConfiguration}'.trim()}" />
+ </property>
+ <property name="tokenEndpointJwtSignatureValidationConfiguration">
+ <ref bean="#{'%{idp.oidc.rovalid.config:shibboleth.oidc.tokenEndpointJwtSignatureValidationConfiguration}'.trim()}" />
+ </property> -->
+ </bean>
<!-- Controller implementation -->
<bean id="shibboleth.oidc.rp.OpenIDConnectStartServlet"
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
index d6e12b0..cae3a8f 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
@@ -91,8 +91,29 @@
class="net.shibboleth.idp.plugin.authn.oidc.rp.metadata.impl.DefaultIssuerIDLookupFunction"
scope="prototype" />
+ <bean id="InitializeRelyingPartyContext"
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.InitializeRelyingPartyContext" scope="prototype"
+ p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
+ p:issuerIDLookupStrategy-ref="shibboleth.oidc.rp.IssuerIDLookupStrategy" />
-
+
+ <bean id="InitializeOutboundMessageContext"
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.InitializeOutboundAuthorizationRequestMessageContext"
+ p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
+ scope="prototype" />
+
+ <bean id="SelectRelyingPartyConfiguration"
+ class="net.shibboleth.idp.profile.impl.SelectRelyingPartyConfiguration" scope="prototype"
+ p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
+ p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
+
+ <bean id="SelectProfileConfiguration"
+ class="net.shibboleth.idp.profile.impl.SelectProfileConfiguration" scope="prototype"
+ p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext" />
+
+ <bean id="AddAuthzRequest" scope="prototype"
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.AddAuthzRequest"
+ p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"/>
<!-- OLD STUFF -->
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-flow.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-flow.xml
index 9d3ac58..5d0d608 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-flow.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-flow.xml
@@ -30,15 +30,18 @@
OP over the normal RP -->
<evaluate expression="OIDCMetadataLookup" />
- <!--
- <evaluate expression="SAMLMetadataLookup" />
+
- <evaluate expression="InitializeRelyingPartyContextFromSAMLPeer" />
+ <evaluate expression="InitializeRelyingPartyContext" />
<evaluate expression="SelectRelyingPartyConfiguration" />
+ <evaluate expression="InitializeOutboundMessageContext" />
+ <evaluate expression="SelectProfileConfiguration" />
+ <evaluate expression="AddAuthzRequest"/>
+
+ <!--
<evaluate expression="PostLookupPopulateAuditContext" />
- <evaluate expression="SelectProfileConfiguration" />
<evaluate expression="InitializeOutboundMessageContext" />
<evaluate expression="InitializeMessageChannelSecurityContext" />
diff --git a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/providermetadata-resolver-system.xml b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/providermetadata-resolver-system.xml
index fded814..f4b918b 100644
--- a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/providermetadata-resolver-system.xml
+++ b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/providermetadata-resolver-system.xml
@@ -78,8 +78,7 @@
class="net.shibboleth.oidc.metadata.cache.impl.DefaultJSONMapParsingStrategy" />
<bean id="shibboleth.oidc.rp.DefaultODICProviderMetadataExpirationTimeStrategy" scope="prototype"
- class="net.shibboleth.oidc.metadata.cache.impl.DefaultOIDCProviderMetadataExpirationTimeStrategy"
- c:duration="PT10M" />
+ class="net.shibboleth.oidc.metadata.cache.impl.DefaultOIDCProviderMetadataExpirationTimeStrategy"/>
<bean id="shibboleth.oidc.rp.DefaultODICProviderSourceMetadataExpirationTimeStrategy" scope="prototype"
class="net.shibboleth.oidc.metadata.cache.impl.DefaultOIDCProviderSourceMetadataExpirationTimeStrategy"
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java
index d389108..6eebef8 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java
@@ -30,14 +30,19 @@ import com.nimbusds.oauth2.sdk.ParseException;
import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
import net.shibboleth.ext.spring.config.IdentifiableBeanPostProcessor;
+import net.shibboleth.ext.spring.service.ReloadableSpringService;
import net.shibboleth.idp.plugin.authn.test.flow.AbstractAuthnXmlFlowExecutionTests;
import net.shibboleth.idp.plugin.authn.test.flow.mock.MockFlowBuilder;
+import net.shibboleth.idp.relyingparty.RelyingPartyConfigurationResolver;
+import net.shibboleth.idp.relyingparty.impl.ReloadingRelyingPartyConfigurationResolver;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
+import net.shibboleth.utilities.java.support.service.ReloadableService;
/** Test the OIDC relying party flow.*/
public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
-
+
+
private final String GOOD_PROVIDER_CONFIGURATION_INFO = "{\n"
+ "\"issuer\": \"https://op.example.com\",\n"
+ "\"authorization_endpoint\": \"https://example.oidc.op.org/o/oauth2/v2/auth\",\n"
@@ -118,6 +123,11 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
"classpath:/net/shibboleth/idp/flows/authn/authn-abstract-flow.xml","authn.abstract",
"classpath:/flows/authn/conditions/conditions-flow.xml","authn/conditions",
"classpath:/conf/authn/authn-events-flow.xml","authn.events");
+
+ /** Constructor.*/
+ public OIDCRPFlowTest() {
+ super("http://idp.example.org");
+ }
@Override
@@ -161,9 +171,10 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
loadBeanDefinitionsFromXmlFile(builderContext, new ClassPathResource("META-INF/net.shibboleth.idp/postconfig.xml"));
-
+ loadBeanDefinitionsFromXmlFile(builderContext, new ClassPathResource("conf/test-relyingparty-resolver-service.xml"));
}
+
@Override
@Nonnull protected ProfileRequestContext buildProfileRequestContext(@Nonnull final String flowId,
@Nonnull final boolean forceAuthn,
@@ -184,6 +195,7 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
"idp.oidc.rp.providerConfigurationDocument","provider_location",
"idp.oidc.rp.redirectURI","https://localhost:8443/idp/profile/Authn/OIDC/RP/callback",
"idp.oidc.rp.scope","email",
+ "idp.entityID", "http://idp.example.com/",
"idp.authn.oidc.rp.proxyIssuer","https://op.example.com");
setMockProperties(mockProperties);
diff --git a/idp-oidc-rp-impl/src/test/resources/conf/test-relying-party-system.xml b/idp-oidc-rp-impl/src/test/resources/conf/test-relying-party-system.xml
new file mode 100644
index 0000000..b38e6e1
--- /dev/null
+++ b/idp-oidc-rp-impl/src/test/resources/conf/test-relying-party-system.xml
@@ -0,0 +1,50 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:context="http://www.springframework.org/schema/context"
+ xmlns:util="http://www.springframework.org/schema/util" xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:c="http://www.springframework.org/schema/c" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+
+ default-init-method="initialize" default-destroy-method="destroy">
+
+ <!-- TODO: left this bean out of the tests
+ p:defaultSecurityConfiguration-ref="%{idp.security.config:shibboleth.DefaultSecurityConfiguration}" -->
+ <bean class="net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver"
+ p:unverifiedConfiguration-ref="shibboleth.UnverifiedRelyingParty"
+ p:defaultConfiguration-ref="shibboleth.DefaultRelyingParty"
+ p:relyingPartyConfigurations-ref="shibboleth.RelyingPartyOverrides"
+
+ p:signingCredentials="#{getObject('shibboleth.SigningCredentials')}"
+ p:encryptionCredentials="#{getObject('shibboleth.EncryptionCredentials')}" />
+
+ <bean id="entityID" class="java.lang.String" c:_0="%{idp.entityID}" />
+
+ <bean id="RelyingParty" abstract="true" class="net.shibboleth.idp.relyingparty.RelyingPartyConfiguration"
+ p:responderId="#{getObject('entityID')}" p:detailedErrorsPredicate="%{idp.errors.detailed:false}" />
+
+ <bean id="shibboleth.UnverifiedRelyingParty" parent="RelyingParty">
+ <property name="profileConfigurations">
+ <list>
+ </list>
+ </property>
+ </bean>
+
+ <!-- Default configuration, with default settings applied for all profiles. -->
+ <bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty">
+ <property name="profileConfigurations">
+ <list>
+ <ref bean="OIDC.SSO" />
+ </list>
+ </property>
+ </bean>
+
+ <!-- Container for any overrides you want to add. -->
+
+ <util:list id="shibboleth.RelyingPartyOverrides">
+
+ </util:list>
+
+
+</beans>
\ No newline at end of file
diff --git a/idp-oidc-rp-impl/src/test/resources/conf/test-relyingparty-resolver-service.xml b/idp-oidc-rp-impl/src/test/resources/conf/test-relyingparty-resolver-service.xml
new file mode 100644
index 0000000..7f7e263
--- /dev/null
+++ b/idp-oidc-rp-impl/src/test/resources/conf/test-relyingparty-resolver-service.xml
@@ -0,0 +1,49 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:context="http://www.springframework.org/schema/context"
+ xmlns:util="http://www.springframework.org/schema/util" xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:c="http://www.springframework.org/schema/c" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+
+ default-init-method="initialize" default-destroy-method="destroy">
+
+
+ <bean id="shibboleth.RelyingPartyResolverService"
+ class="net.shibboleth.ext.spring.service.ReloadableSpringService"
+ p:serviceConfigurations-ref="ExtendedRelyingPartyResolverResources"
+ p:failFast="%{idp.service.relyingparty.failFast:%{idp.service.failFast:false}}"
+ p:reloadCheckDelay="%{idp.service.relyingparty.checkInterval:PT0S}"
+ p:beanPostProcessors-ref="shibboleth.IdentifiableBeanPostProcessor"
+ p:beanFactoryPostProcessors-ref="shibboleth.PropertySourcesPlaceholderConfigurer">
+ <constructor-arg name="claz"
+ value="net.shibboleth.idp.relyingparty.RelyingPartyConfigurationResolver" />
+ <constructor-arg name="strategy">
+ <bean class="net.shibboleth.ext.spring.service.ClassBasedServiceStrategy"
+ c:serviceableClaz="net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver" />
+ </constructor-arg>
+ </bean>
+
+ <!-- Auto-append system config file to resource set. -->
+ <bean id ="ExtendedRelyingPartyResolverResources" class="net.shibboleth.ext.spring.factory.CombiningListFactoryBean"
+ p:firstList-ref="#{'%{idp.service.relyingparty.resources:shibboleth.RelyingPartyResolverResources}'.trim()}" >
+ <property name="secondList">
+ <util:list >
+ <value>classpath:/conf/test-relying-party-system.xml</value>
+ </util:list>
+ </property>
+ </bean>
+
+ <bean id="shibboleth.RelyingPartyConfigurationResolver"
+ class="net.shibboleth.idp.relyingparty.impl.ReloadingRelyingPartyConfigurationResolver"
+ c:resolverService-ref="shibboleth.RelyingPartyResolverService" />
+
+ <util:list id="shibboleth.RelyingPartyResolverResources">
+ <!-- <value>%{idp.home}/conf/relying-party.xml</value>
+ <value>%{idp.home}/conf/credentials.xml</value> -->
+ </util:list>
+
+
+
+</beans>
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list