[java-identity-provider] branch main updated: Resources for testing OIDC via testbed.
Scott Cantor
cantor.2 at osu.edu
Tue Nov 30 19:29:49 UTC 2021
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=1a959d7c8ec9236eab36ea463fabca742a82aa27
The following commit(s) were added to refs/heads/main by this push:
new 1a959d7c8 Resources for testing OIDC via testbed.
1a959d7c8 is described below
commit 1a959d7c8ec9236eab36ea463fabca742a82aa27
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Nov 30 14:29:46 2021 -0500
Resources for testing OIDC via testbed.
---
.../src/test/resources/conf/attribute-filter.xml | 206 ++++++++++
.../src/test/resources/conf/attribute-resolver.xml | 106 +++++
.../resources/conf/attributes/default-rules.xml | 30 ++
.../resources/conf/attributes/oidc-claim-rules.xml | 428 +++++++++++++++++++++
idp-conf/src/test/resources/conf/credentials.xml | 71 ++++
idp-conf/src/test/resources/conf/global.xml | 5 +-
idp-conf/src/test/resources/conf/idp.properties | 2 +-
.../resources/conf/oidc-clientinfo-resolvers.xml | 35 ++
.../src/test/resources/conf/oidc-credentials.xml | 68 ++++
idp-conf/src/test/resources/conf/oidc.properties | 83 ++++
idp-conf/src/test/resources/conf/relying-party.xml | 7 +-
.../resources/credentials/idp-encryption-rsa.jwk | 13 +
.../test/resources/credentials/idp-signing-es.jwk | 9 +
.../test/resources/credentials/idp-signing-rs.jwk | 13 +
.../test/resources/metadata/example-metadata.xml | 10 +-
.../resources/static/openid-configuration.json | 137 +++++++
16 files changed, 1211 insertions(+), 12 deletions(-)
diff --git a/idp-conf/src/test/resources/conf/attribute-filter.xml b/idp-conf/src/test/resources/conf/attribute-filter.xml
new file mode 100644
index 000000000..2ae3b0dc3
--- /dev/null
+++ b/idp-conf/src/test/resources/conf/attribute-filter.xml
@@ -0,0 +1,206 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ This file is an EXAMPLE policy file. While the policy presented in this
+ example file is illustrative of some simple cases, it relies on the names of
+ non-existent example services and the example attributes demonstrated in the
+ default attribute-resolver.xml file.
+
+ This example does contain some usable "general purpose" policies that may be
+ useful in conjunction with specific deployment choices, but those policies may
+ not be applicable to your specific needs or constraints.
+-->
+<AttributeFilterPolicyGroup id="ShibbolethFilterPolicy"
+ xmlns="urn:mace:shibboleth:2.0:afp"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:oidc="urn:mace:shibboleth:2.0:afp:oidc"
+ xsi:schemaLocation="urn:mace:shibboleth:2.0:afp http://shibboleth.net/schema/idp/shibboleth-afp.xsd
+ urn:mace:shibboleth:2.0:afp:oidc http://shibboleth.net/schema/oidc/shibboleth-afp-oidc.xsd">
+
+ <!--
+ Example rule relying on a locally applied tag in metadata to trigger attribute
+ release of some specific attributes. Add additional attributes as desired.
+ -->
+ <AttributeFilterPolicy id="Per-Attribute-singleValued">
+ <PolicyRequirementRule xsi:type="ANY" />
+
+ <AttributeRule attributeID="eduPersonPrincipalName">
+ <PermitValueRule xsi:type="EntityAttributeExactMatch"
+ attributeName="http://shibboleth.net/ns/attributes/releaseAllValues"
+ attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
+ attributeValue="eduPersonPrincipalName" />
+ </AttributeRule>
+
+ <AttributeRule attributeID="mail">
+ <PermitValueRule xsi:type="EntityAttributeExactMatch"
+ attributeName="http://shibboleth.net/ns/attributes/releaseAllValues"
+ attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
+ attributeValue="mail" />
+ </AttributeRule>
+ </AttributeFilterPolicy>
+
+ <!--
+ Same as above but more efficient form for an attribute with multiple values.
+ -->
+ <AttributeFilterPolicy id="Per-Attribute-Affiliation">
+ <PolicyRequirementRule xsi:type="EntityAttributeExactMatch"
+ attributeName="http://shibboleth.net/ns/attributes/releaseAllValues"
+ attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
+ attributeValue="eduPersonScopedAffiliation" />
+
+ <AttributeRule attributeID="eduPersonScopedAffiliation" permitAny="true" />
+ </AttributeFilterPolicy>
+
+ <!--
+ Example rule for honoring Subject ID requirement tag in metadata.
+ The example supplies pairwise-id if subject-id isn't explicitly required.
+ -->
+ <AttributeFilterPolicy id="subject-identifiers">
+ <PolicyRequirementRule xsi:type="ANY" />
+
+ <AttributeRule attributeID="samlPairwiseID">
+ <PermitValueRule xsi:type="OR">
+ <Rule xsi:type="EntityAttributeExactMatch"
+ attributeName="urn:oasis:names:tc:SAML:profiles:subject-id:req"
+ attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
+ attributeValue="pairwise-id" />
+ <Rule xsi:type="EntityAttributeExactMatch"
+ attributeName="urn:oasis:names:tc:SAML:profiles:subject-id:req"
+ attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
+ attributeValue="any" />
+ </PermitValueRule>
+ </AttributeRule>
+
+ <AttributeRule attributeID="samlSubjectID">
+ <PermitValueRule xsi:type="EntityAttributeExactMatch"
+ attributeName="urn:oasis:names:tc:SAML:profiles:subject-id:req"
+ attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
+ attributeValue="subject-id" />
+ </AttributeRule>
+ </AttributeFilterPolicy>
+
+ <!-- Release an additional attribute to an SP. -->
+ <AttributeFilterPolicy id="example1">
+ <PolicyRequirementRule xsi:type="Requester" value="https://sp.example.org" />
+
+ <AttributeRule attributeID="uid" permitAny="true" />
+ </AttributeFilterPolicy>
+
+ <!-- Release eduPersonScopedAffiliation to two specific SPs. -->
+ <AttributeFilterPolicy id="example2">
+ <PolicyRequirementRule xsi:type="OR">
+ <Rule xsi:type="Requester" value="https://sp.example.org" />
+ <Rule xsi:type="Requester" value="https://another.example.org/shibboleth" />
+ </PolicyRequirementRule>
+
+ <AttributeRule attributeID="eduPersonScopedAffiliation" permitAny="true" />
+ </AttributeFilterPolicy>
+
+ <!-- OIDC examples. -->
+
+ <!--
+ <AttributeFilterPolicy id="OPENID_SCOPE">
+ <PolicyRequirementRule xsi:type="oidc:OIDCScope" value="openid" />
+ <AttributeRule attributeID="subject">
+ <PermitValueRule xsi:type="ANY" />
+ </AttributeRule>
+ <AttributeRule attributeID="subject-public">
+ <PermitValueRule xsi:type="ANY" />
+ </AttributeRule>
+ <AttributeRule attributeID="subject-pairwise">
+ <PermitValueRule xsi:type="ANY" />
+ </AttributeRule>
+ </AttributeFilterPolicy>
+
+ <AttributeFilterPolicy id="OPENID_SCOPE_EMAIL">
+ <PolicyRequirementRule xsi:type="oidc:OIDCScope" value="email" />
+ <AttributeRule attributeID="mail">
+ <PermitValueRule xsi:type="ANY" />
+ </AttributeRule>
+ <AttributeRule attributeID="email_verified">
+ <PermitValueRule xsi:type="ANY" />
+ </AttributeRule>
+ </AttributeFilterPolicy>
+
+ <AttributeFilterPolicy id="OPENID_SCOPE_ADDRESS">
+ <PolicyRequirementRule xsi:type="oidc:OIDCScope" value="address" />
+ <AttributeRule attributeID="address">
+ <PermitValueRule xsi:type="ANY" />
+ </AttributeRule>
+ </AttributeFilterPolicy>
+
+ <AttributeFilterPolicy id="OPENID_SCOPE_PHONE">
+ <PolicyRequirementRule xsi:type="oidc:OIDCScope" value="phone" />
+ <AttributeRule attributeID="telephoneNumber">
+ <PermitValueRule xsi:type="ANY" />
+ </AttributeRule>
+ <AttributeRule attributeID="phone_number_verified">
+ <PermitValueRule xsi:type="ANY" />
+ </AttributeRule>
+ </AttributeFilterPolicy>
+
+ <AttributeFilterPolicy id="OPENID_SCOPE_PROFILE">
+ <PolicyRequirementRule xsi:type="oidc:OIDCScope" value="profile" />
+ <AttributeRule attributeID="displayName">
+ <PermitValueRule xsi:type="ANY" />
+ </AttributeRule>
+ <AttributeRule attributeID="sn">
+ <PermitValueRule xsi:type="ANY" />
+ </AttributeRule>
+ <AttributeRule attributeID="givenName">
+ <PermitValueRule xsi:type="ANY" />
+ </AttributeRule>
+ <AttributeRule attributeID="preferredLanguage">
+ <PermitValueRule xsi:type="ANY" />
+ </AttributeRule>
+ <AttributeRule attributeID="eduPersonNickname">
+ <PermitValueRule xsi:type="ANY" />
+ </AttributeRule>
+ <AttributeRule attributeID="uid">
+ <PermitValueRule xsi:type="ANY" />
+ </AttributeRule>
+ <AttributeRule attributeID="middle_name">
+ <PermitValueRule xsi:type="ANY" />
+ </AttributeRule>
+ <AttributeRule attributeID="profile">
+ <PermitValueRule xsi:type="ANY" />
+ </AttributeRule>
+ <AttributeRule attributeID="picture">
+ <PermitValueRule xsi:type="ANY" />
+ </AttributeRule>
+ <AttributeRule attributeID="website">
+ <PermitValueRule xsi:type="ANY" />
+ </AttributeRule>
+ <AttributeRule attributeID="gender">
+ <PermitValueRule xsi:type="ANY" />
+ </AttributeRule>
+ <AttributeRule attributeID="birthdate">
+ <PermitValueRule xsi:type="ANY" />
+ </AttributeRule>
+ <AttributeRule attributeID="zoneinfo">
+ <PermitValueRule xsi:type="ANY" />
+ </AttributeRule>
+ <AttributeRule attributeID="updated_at">
+ <PermitValueRule xsi:type="ANY" />
+ </AttributeRule>
+ </AttributeFilterPolicy>
+
+
+ <AttributeFilterPolicy id="REQUESTED_CLAIMS">
+ <PolicyRequirementRule xsi:type="ANY" />
+ <AttributeRule attributeID="picture">
+ <PermitValueRule xsi:type="oidc:AttributeInOIDCRequestedClaims" />
+ </AttributeRule>
+ <AttributeRule attributeID="mail">
+ <PermitValueRule xsi:type="oidc:AttributeInOIDCRequestedClaims" matchOnlyIDToken="true" />
+ </AttributeRule>
+ <AttributeRule attributeID="telephoneNumber">
+ <PermitValueRule xsi:type="oidc:AttributeInOIDCRequestedClaims" matchOnlyUserInfo="true" />
+ </AttributeRule>
+ <AttributeRule attributeID="displayName">
+ <PermitValueRule xsi:type="oidc:AttributeInOIDCRequestedClaims" matchOnlyUserInfo="true"
+ onlyIfEssential="true" />
+ </AttributeRule>
+ </AttributeFilterPolicy>
+ -->
+
+</AttributeFilterPolicyGroup>
diff --git a/idp-conf/src/test/resources/conf/attribute-resolver.xml b/idp-conf/src/test/resources/conf/attribute-resolver.xml
new file mode 100644
index 000000000..2f5496472
--- /dev/null
+++ b/idp-conf/src/test/resources/conf/attribute-resolver.xml
@@ -0,0 +1,106 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+This file is a rudimentary example. While it is semi-functional, it isn't very
+interesting. It is here only as a starting point for your deployment process
+to avoid any dependency on components like an LDAP directory.
+
+Very few attribute definitions and data connectors are demonstrated, and the
+data is derived statically from the logged-in username and a static example
+connector.
+
+The file(s) in the examples directory contain more examples that involve more
+complex approaches. Deployers should refer to the documentation for a complete
+list of possible components and their options.
+-->
+<AttributeResolver
+ xmlns="urn:mace:shibboleth:2.0:resolver"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:oidc="urn:mace:shibboleth:2.0:resolver:oidc"
+ xsi:schemaLocation="urn:mace:shibboleth:2.0:resolver http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd
+ urn:mace:shibboleth:2.0:resolver:oidc http://shibboleth.net/schema/oidc/shibboleth-attribute-encoder-oidc.xsd">
+
+
+ <!-- ========================================== -->
+ <!-- Attribute Definitions -->
+ <!-- ========================================== -->
+
+ <!--
+ <AttributeDefinition id="subject-public" xsi:type="Scoped" scope="%{idp.scope}"
+ activationConditionRef="shibboleth.oidc.Conditions.PublicRequired">
+ <InputAttributeDefinition ref="uid" />
+ <AttributeEncoder xsi:type="oidc:OIDCScopedString" name="sub" />
+ </AttributeDefinition>
+
+ <AttributeDefinition id="subject-pairwise" xsi:type="Scoped" scope="%{idp.scope}"
+ activationConditionRef="shibboleth.oidc.Conditions.PairwiseRequired">
+ <InputDataConnector ref="computedSubjectId" attributeNames="subjectId"/>
+ <AttributeEncoder xsi:type="oidc:OIDCScopedString" name="sub" />
+ </AttributeDefinition>
+ -->
+
+ <!--
+ The EPPN is the "standard" federated username in higher ed.
+ For guidelines on the implementation of this attribute, refer
+ to the Shibboleth and eduPerson documentation. Above all, do
+ not expose a value for this attribute without considering the
+ long term implications.
+ -->
+ <AttributeDefinition id="eduPersonPrincipalName" xsi:type="Scoped" scope="%{idp.scope}">
+ <InputAttributeDefinition ref="uid" />
+ </AttributeDefinition>
+
+ <!--
+ The uid is the closest thing to a "standard" LDAP attribute
+ representing a local username, but you should generally *never*
+ expose uid to federated services, as it is rarely globally unique.
+ -->
+ <AttributeDefinition id="uid" xsi:type="PrincipalName" />
+
+ <!--
+ In the rest of the world, the email address is the standard identifier,
+ despite the problems with that practice. Consider making the EPPN
+ value the same as your official email addresses whenever possible.
+ -->
+ <AttributeDefinition id="mail" xsi:type="Template">
+ <InputAttributeDefinition ref="uid" />
+ <Template>
+ <![CDATA[
+ ${uid}@example.org
+ ]]>
+ </Template>
+ </AttributeDefinition>
+
+ <!--
+ This is an example of an attribute sourced from a data connector.
+ -->
+ <AttributeDefinition id="eduPersonScopedAffiliation" xsi:type="Scoped" scope="%{idp.scope}">
+ <InputDataConnector ref="staticAttributes" attributeNames="affiliation" />
+ </AttributeDefinition>
+
+
+ <!-- ========================================== -->
+ <!-- Data Connectors -->
+ <!-- ========================================== -->
+
+ <!--
+ Data Connector for generating 'sub' claim. It may be used to generate both
+ public and pairwise subject values because it recognizes the OIDC sector_id
+ if used during client registration.
+ -->
+ <!--
+ <DataConnector id="computedSubjectId" xsi:type="ComputedId"
+ generatedAttributeID="subjectId"
+ salt="%{idp.oidc.subject.salt}"
+ algorithm="%{idp.oidc.subject.algorithm:SHA}"
+ encoding="BASE32">
+ <InputAttributeDefinition ref="%{idp.oidc.subject.sourceAttribute}"/>
+ </DataConnector>
+ -->
+
+ <DataConnector id="staticAttributes" xsi:type="Static">
+ <Attribute id="affiliation">
+ <Value>member</Value>
+ </Attribute>
+ </DataConnector>
+
+</AttributeResolver>
diff --git a/idp-conf/src/test/resources/conf/attributes/default-rules.xml b/idp-conf/src/test/resources/conf/attributes/default-rules.xml
new file mode 100644
index 000000000..7c6c1e916
--- /dev/null
+++ b/idp-conf/src/test/resources/conf/attributes/default-rules.xml
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:context="http://www.springframework.org/schema/context"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:c="http://www.springframework.org/schema/c"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+
+ default-init-method="initialize"
+ default-destroy-method="destroy">
+
+ <!-- Default Attribute transcoding rules. -->
+
+ <!--
+ Many if not most of these attributes are not suited or may even be actively discouraged
+ from use in federated protocols, but this is merely a set of well-known definitions, not
+ a recommended set to support or use.
+ -->
+
+ <import resource="inetOrgPerson.xml" />
+ <import resource="eduPerson.xml" />
+ <import resource="eduCourse.xml" />
+ <import resource="samlSubject.xml" />
+
+<!-- <import resource="oidc-claim-rules.xml" /> -->
+
+</beans>
diff --git a/idp-conf/src/test/resources/conf/attributes/oidc-claim-rules.xml b/idp-conf/src/test/resources/conf/attributes/oidc-claim-rules.xml
new file mode 100644
index 000000000..9de853b27
--- /dev/null
+++ b/idp-conf/src/test/resources/conf/attributes/oidc-claim-rules.xml
@@ -0,0 +1,428 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:context="http://www.springframework.org/schema/context"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:c="http://www.springframework.org/schema/c"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+
+ default-init-method="initialize"
+ default-destroy-method="destroy">
+
+ <!-- https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims -->
+
+ <bean parent="shibboleth.TranscodingRuleLoader">
+ <constructor-arg>
+ <list>
+
+ <!-- Typical inetOrgPerson attributes that map to standard claims. -->
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">displayName</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.name">name</prop>
+ <prop key="displayName.en">Display name</prop>
+ <prop key="displayName.de">Anzeigename</prop>
+ <prop key="displayName.fr">Nom</prop>
+ <prop key="displayName.it">Nome</prop>
+ <prop key="displayName.ja">表示名</prop>
+ <prop key="description.en">The name that should appear in white-pages-like applications for this person.</prop>
+ <prop key="description.de">Anzeigename</prop>
+ <prop key="description.fr">Nom complet d'affichage</prop>
+ <prop key="description.it">Nome</prop>
+ <prop key="description.ja">アプリケーションでの表示に用いられる英字氏名</prop>
+ </props>
+ </property>
+ </bean>
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">givenName</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.name">given_name</prop>
+ <prop key="displayName.en">Given name</prop>
+ <prop key="displayName.de">Vorname</prop>
+ <prop key="displayName.fr">Prénom</prop>
+ <prop key="displayName.it">Nome</prop>
+ <prop key="displayName.ja">名</prop>
+ <prop key="description.en">Given name of a person</prop>
+ <prop key="description.de">Vorname</prop>
+ <prop key="description.fr">Prénom de l'utilisateur</prop>
+ <prop key="description.it">Nome</prop>
+ <prop key="description.ja">氏名(名)の英語表記</prop>
+ </props>
+ </property>
+ </bean>
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">homePhone</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.name">phone_number</prop>
+ <prop key="displayName.en">Private phone number</prop>
+ <prop key="displayName.de">Telefon Privat</prop>
+ <prop key="displayName.fr">Teléphone personnel</prop>
+ <prop key="displayName.it">Numero di telefono privato</prop>
+ <prop key="displayName.ja">自宅電話番号</prop>
+ <prop key="description.en">Private phone number</prop>
+ <prop key="description.de">Private Telefonnummer</prop>
+ <prop key="description.fr">Numéro de téléphone de domicile de la personne</prop>
+ <prop key="description.it">Numero di telefono privato</prop>
+ <prop key="description.ja">自宅の電話番号</prop>
+ </props>
+ </property>
+ </bean>
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">mail</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.name">email</prop>
+ <prop key="displayName.en">E-mail</prop>
+ <prop key="displayName.de">E-Mail</prop>
+ <prop key="displayName.fr">Email</prop>
+ <prop key="displayName.it">E-mail</prop>
+ <prop key="displayName.ja">メールアドレス</prop>
+ <prop key="description.en">E-Mail: Preferred address for e-mail to be sent to this person</prop>
+ <prop key="description.de">E-Mail-Adresse</prop>
+ <prop key="description.de-ch">E-Mail Adresse</prop>
+ <prop key="description.fr">Adresse de courrier électronique</prop>
+ <prop key="description.it">E-Mail: l'indirizzo e-mail preferito dall'utente</prop>
+ <prop key="description.ja">メールアドレス</prop>
+ </props>
+ </property>
+ </bean>
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">preferredLanguage</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.name">locale</prop>
+ <prop key="displayName.en">Preferred Language</prop>
+ <prop key="displayName.de">Bevorzugte Sprache</prop>
+ <prop key="displayName.fr">Langue préférée</prop>
+ <prop key="displayName.it">Lingua preferita</prop>
+ <prop key="displayName.ja">希望言語</prop>
+ <prop key="description.en">Preferred language: Users preferred language (see RFC1766)</prop>
+ <prop key="description.de">Bevorzugte Sprache (siehe RFC1766)</prop>
+ <prop key="description.fr">Exemple: fr, de, it, en, ... (voir RFC1766)</prop>
+ <prop key="description.it">Lingua preferita: la lingua preferita dall'utente (cfr. RFC1766)</prop>
+ <prop key="description.ja">利用者が希望する言語(RFC1766 を参照)</prop>
+ </props>
+ </property>
+ </bean>
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">sn</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.name">family_name</prop>
+ <prop key="displayName.en">Surname</prop>
+ <prop key="displayName.de">Nachname</prop>
+ <prop key="displayName.fr">Nom de famille</prop>
+ <prop key="displayName.it">Cognome</prop>
+ <prop key="displayName.ja">姓</prop>
+ <prop key="description.en">Surname or family name</prop>
+ <prop key="description.de">Familienname</prop>
+ <prop key="description.fr">Nom de famille de l'utilisateur.</prop>
+ <prop key="description.it">Cognome dell'utilizzatore</prop>
+ <prop key="description.ja">氏名(姓)の英語表記</prop>
+ </props>
+ </property>
+ </bean>
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">telephoneNumber</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.name">phone_number</prop>
+ <prop key="displayName.en">Business phone number</prop>
+ <prop key="displayName.de">Telefon Geschäft</prop>
+ <prop key="displayName.fr">Teléphone professionnel</prop>
+ <prop key="displayName.it">Numero di telefono dell'ufficio</prop>
+ <prop key="displayName.ja">所属機関内電話番号</prop>
+ <prop key="description.en">Business phone number: Office or campus phone number</prop>
+ <prop key="description.de">Telefonnummer am Arbeitsplatz</prop>
+ <prop key="description.fr">Teléphone de l'institut, de l'université</prop>
+ <prop key="description.it">Numero di telefono dell'ufficio</prop>
+ <prop key="description.ja">所属機関での利用者の電話番号</prop>
+ </props>
+ </property>
+ </bean>
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">uid</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.name">preferred_username</prop>
+ <prop key="displayName.en">User ID</prop>
+ <prop key="displayName.de">Benutzer-ID</prop>
+ <prop key="displayName.fr">ID utilisateur</prop>
+ <prop key="displayName.it">ID dell'utente</prop>
+ <prop key="displayName.ja">ユーザID</prop>
+ <prop key="description.en">A unique identifier for a person, mainly used for user identification within the user's home organization.</prop>
+ <prop key="description.de">Eine eindeutige Nummer für eine Person, welche hauptsächlich zur Identifikation innerhalb der Organisation benutzt wird.</prop>
+ <prop key="description.fr">Identifiant de connexion d'une personnes sur les systèmes informatiques.</prop>
+ <prop key="description.it">Identificativo unico della persona, usato per l'identificazione dell'utente all'interno della organizzazione di appartenenza.</prop>
+ <prop key="description.ja">所属機関内で一意の利用者識別子</prop>
+ </props>
+ </property>
+ </bean>
+
+ <!-- eduPerson attributes that map to standard claims. -->
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">eduPersonNickname</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.name">nickname</prop>
+ <prop key="displayName.en">Nickname</prop>
+ <prop key="displayName.de">Kurzname</prop>
+ <prop key="displayName.de-ch">Übername</prop>
+ <prop key="displayName.fr">Surnom</prop>
+ <prop key="displayName.it">Diminutivo</prop>
+ <prop key="displayName.ja">ニックネーム</prop>
+ <prop key="description.en">Person's nickname, or the informal name by which they are accustomed to be hailed.</prop>
+ <prop key="description.de">Kurzname einer Person, oder üblicher Rufname zur Begrüßung.</prop>
+ <prop key="description.de-ch">Übername einer Person, oder üblicher Rufname zur Begrüssung.</prop>
+ <prop key="description.fr">Nom personnalisable pour un usage informel.</prop>
+ <prop key="description.it">Diminutivo della persona, o soprannome.</prop>
+ <prop key="description.ja">利用者のニックネームもしくは通称</prop>
+ </props>
+ </property>
+ </bean>
+
+ <!-- A subset of the major eduPerson attributes that have no standard claim mapping. -->
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">eduPersonAssurance</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.name">eduPersonAssurance</prop>
+ <prop key="displayName.en">Assurance level</prop>
+ <prop key="displayName.de">Vertrauensgrad</prop>
+ <prop key="displayName.fr">Niveau de confiance</prop>
+ <prop key="displayName.it">Livello di sicurezza</prop>
+ <prop key="displayName.ja">保証レベル</prop>
+ <prop key="description.en">Set of URIs that assert compliance with specific standards for identity assurance.</prop>
+ <prop key="description.de">URIs die eine gewisse Zusicherung für spezifische Standards des Vertrauens beinhalten</prop>
+ <prop key="description.fr">Un ensemble d'URI qui attestent la conformité selon un standard pour les niveaux d'assurance d'identités</prop>
+ <prop key="description.it">Un insieme di URI che asseriscono l'osservanza dei livelli di sicurezza richiesti</prop>
+ <prop key="description.ja">IDの保証レベルに関して特定の基準に準拠していることを示すURI</prop>
+ </props>
+ </property>
+ </bean>
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">eduPersonEntitlement</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.name">eduPersonEntitlement</prop>
+ <prop key="displayName.en">Entitlement</prop>
+ <prop key="displayName.de">Berechtigung</prop>
+ <prop key="displayName.fr">Entitlement</prop>
+ <prop key="displayName.it">Prerogativa</prop>
+ <prop key="displayName.ja">資格情報</prop>
+ <prop key="description.en">Member of: URI (either URL or URN) that indicates a set of rights to specific resources based on an agreement across the releavant community</prop>
+ <prop key="description.de">Zeichenkette, die Rechte für spezifische Ressourcen beschreibt</prop>
+ <prop key="description.fr">Membre de: URI (soit une URL ou une URN) décrivant un droit spécific d'accès.</prop>
+ <prop key="description.it">Membro delle seguenti URI (sia URL o URN) che rappresentano diritti specifici d'accesso validi in tutta la communità</prop>
+ <prop key="description.ja">特定のアプリケーションもしくはコミュニティ内の複数リソースへのアクセス権限を持つことを示すURI(URLもしくはURN)</prop>
+ </props>
+ </property>
+ </bean>
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">eduPersonPrincipalName</prop>
+ <prop key="transcoder">OIDCScopedStringTranscoder</prop>
+ <prop key="oidc.name">eduPersonPrincipalName</prop>
+ <prop key="displayName.en">Principal name</prop>
+ <prop key="displayName.de">Persönliche ID</prop>
+ <prop key="displayName.fr">Principal Name</prop>
+ <prop key="displayName.it">Principal Name</prop>
+ <prop key="displayName.ja">プリンシパルID</prop>
+ <prop key="description.en">A unique identifier for a person, mainly for inter-institutional user identification.</prop>
+ <prop key="description.de">Eindeutige Benutzeridentifikation</prop>
+ <prop key="description.de-ch">Eindeutige Benützeridentifikation</prop>
+ <prop key="description.fr">L'identifiant unique de l'utilisateur</prop>
+ <prop key="description.it">Un ID personale che identifica chiaramente l'utente in seno alla sua organizzazione</prop>
+ <prop key="description.ja">フェデレーション内で一意かつ永続的な利用者識別子</prop>
+ </props>
+ </property>
+ </bean>
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">eduPersonScopedAffiliation</prop>
+ <prop key="transcoder">OIDCScopedStringTranscoder</prop>
+ <prop key="oidc.name">eduPersonScopedAffiliation</prop>
+ <prop key="displayName.en">Scoped affiliation</prop>
+ <prop key="displayName.de">Zugehörigkeit</prop>
+ <prop key="displayName.fr">Affiliation</prop>
+ <prop key="displayName.it">Tipo di membro</prop>
+ <prop key="displayName.ja">スコープ付き職位</prop>
+ <prop key="description.en">Specifies the person's affiliation within a particular security domain</prop>
+ <prop key="description.de">Art der Zugehörigkeit zur Heimatorganisation</prop>
+ <prop key="description.de-ch">Art der Zugehörigkeit zur Heimorganisation</prop>
+ <prop key="description.fr">Type d'affiliation dans l'organisation</prop>
+ <prop key="description.it">Tipo di membro: Tipo di lavoro svolto per l'organizzazione</prop>
+ <prop key="description.ja">セキュリティドメインのスコープが付いた所属機関における職位</prop>
+ </props>
+ </property>
+ </bean>
+
+ <!-- The remainder are standard OIDC claims, which we map based on the actual claim name. -->
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">address</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.asObject">true</prop>
+ <prop key="oidc.name">address</prop>
+ <prop key="displayName.en">Postal address</prop>
+ </props>
+ </property>
+ </bean>
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">birthdate</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.name">birthdate</prop>
+ <prop key="displayName.en">Date of birth</prop>
+ </props>
+ </property>
+ </bean>
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">email_verified</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.name">email_verified</prop>
+ <prop key="oidc.asBoolean">true</prop>
+ <prop key="displayName.en">E-mail verification status</prop>
+ <prop key="description.en">Indicates whether e-mail address has been verified by the issuer</prop>
+ </props>
+ </property>
+ </bean>
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">gender</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.name">gender</prop>
+ <prop key="displayName.en">Gender</prop>
+ </props>
+ </property>
+ </bean>
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">middle_name</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.name">middle_name</prop>
+ <prop key="displayName.en">Middle name</prop>
+ </props>
+ </property>
+ </bean>
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">phone_number_verified</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.name">phone_number_verified</prop>
+ <prop key="oidc.asBoolean">true</prop>
+ <prop key="displayName.en">Phone number verification status</prop>
+ <prop key="description.en">Indicates whether phone number has been verified by the issuer</prop>
+ </props>
+ </property>
+ </bean>
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">picture</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.name">picture</prop>
+ <prop key="displayName.en">Picture</prop>
+ <prop key="description.en">URL of personal photo</prop>
+ </props>
+ </property>
+ </bean>
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">profile</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.name">profile</prop>
+ <prop key="displayName.en">Profile page</prop>
+ <prop key="description.en">URL of personal profile page</prop>
+ </props>
+ </property>
+ </bean>
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">website</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.name">website</prop>
+ <prop key="displayName.en">Web site</prop>
+ <prop key="description.en">URL to personal web site</prop>
+ </props>
+ </property>
+ </bean>
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">updated_at</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.name">updated_at</prop>
+ <prop key="oidc.asInteger">true</prop>
+ <prop key="displayName.en">Last update of information</prop>
+ </props>
+ </property>
+ </bean>
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">zoneinfo</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.name">zoneinfo</prop>
+ <prop key="displayName.en">Time zone</prop>
+ </props>
+ </property>
+ </bean>
+
+ </list>
+ </constructor-arg>
+ </bean>
+
+</beans>
diff --git a/idp-conf/src/test/resources/conf/credentials.xml b/idp-conf/src/test/resources/conf/credentials.xml
new file mode 100644
index 000000000..afb12d854
--- /dev/null
+++ b/idp-conf/src/test/resources/conf/credentials.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:context="http://www.springframework.org/schema/context"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:c="http://www.springframework.org/schema/c"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+
+ default-init-method="initialize"
+ default-destroy-method="destroy">
+
+ <!--
+ NOTE: if you're using a legacy relying-party.xml file from a V2 configuration, this file is ignored.
+
+ This defines the signing and encryption key and certificate pairs referenced by your relying-party.xml
+ configuration. You don't normally need to touch this, unless you have advanced requirements such as
+ supporting multiple sets of keys for different relying parties, in which case you may want to define
+ all your credentials here for convenience.
+ -->
+
+ <!--
+ The list of ALL of your IdP's signing credentials. If you define additional signing credentials,
+ for example for specific relying parties or different key types, make sure to include them within this list.
+ -->
+ <util:list id="shibboleth.SigningCredentials">
+ <ref bean="shibboleth.DefaultSigningCredential" />
+ </util:list>
+
+ <!-- Your IdP's default signing key, set via property file. -->
+ <bean id="shibboleth.DefaultSigningCredential"
+ class="net.shibboleth.idp.profile.spring.factory.BasicX509CredentialFactoryBean"
+ p:privateKeyResource="%{idp.signing.key}"
+ p:certificateResource="%{idp.signing.cert}"
+ p:entityId-ref="entityID" />
+
+ <!-- Your IdP's default client TLS credential, by default the same as the default signing credential. -->
+ <alias alias="shibboleth.DefaultClientTLSCredential" name="shibboleth.DefaultSigningCredential" />
+
+ <!--
+ The list of ALL of your IdP's encryption credentials. By default this is just an alias
+ for 'shibboleth.DefaultEncryptionCredentials'. It could be re-defined as
+ a list with additional credentials if needed.
+ -->
+ <alias alias="shibboleth.EncryptionCredentials" name="shibboleth.DefaultEncryptionCredentials" />
+
+ <!-- Your IdP's default encryption (really decryption) keys, set via property file. -->
+ <util:list id="shibboleth.DefaultEncryptionCredentials">
+ <bean class="net.shibboleth.idp.profile.spring.factory.BasicX509CredentialFactoryBean"
+ p:privateKeyResource="%{idp.encryption.key}"
+ p:certificateResource="%{idp.encryption.cert}"
+ p:entityId-ref="entityID" />
+
+ <!--
+ For key rollover, uncomment and point to your original keypair, and use the one above
+ to point to your new keypair. Once metadata has propagated, comment this one out again.
+ -->
+ <!--
+ <bean class="net.shibboleth.idp.profile.spring.factory.BasicX509CredentialFactoryBean"
+ p:privateKeyResource="%{idp.encryption.key.2}"
+ p:certificateResource="%{idp.encryption.cert.2}"
+ p:entityId-ref="entityID" />
+ -->
+ </util:list>
+
+ <!-- OIDC extension default credential definitions -->
+<!-- <import resource="oidc-credentials.xml" /> -->
+
+</beans>
diff --git a/idp-conf/src/test/resources/conf/global.xml b/idp-conf/src/test/resources/conf/global.xml
index 1909cb450..f19f0c163 100644
--- a/idp-conf/src/test/resources/conf/global.xml
+++ b/idp-conf/src/test/resources/conf/global.xml
@@ -88,6 +88,9 @@
<jdbc:script location="classpath:/test/test-jdbc.sql"/>
</jdbc:initialize-database>
+ <bean id="shibboleth.oidc.OpenIDConfiguration" class="org.springframework.core.io.ClassPathResource"
+ c:path="/static/openid-configuration.json" />
+
<!--
<bean id="shibboleth.authn.TOTP.SeedSource" parent="shibboleth.authn.TOTP.StaticSeedSource">
<property name="seeds">
@@ -102,7 +105,6 @@
</bean>
-->
- <!--
<bean id="shibboleth.ExtensionSchemas" parent="shibboleth.DefaultExtensionSchemas">
<property name="sourceList">
<list merge="true">
@@ -110,6 +112,5 @@
</list>
</property>
</bean>
- -->
</beans>
diff --git a/idp-conf/src/test/resources/conf/idp.properties b/idp-conf/src/test/resources/conf/idp.properties
index 65bc787cc..2b290c34c 100644
--- a/idp-conf/src/test/resources/conf/idp.properties
+++ b/idp-conf/src/test/resources/conf/idp.properties
@@ -3,7 +3,7 @@
#idp.searchForProperties = false
# Load any additional property resources from a comma-delimited list
-idp.additionalProperties = /conf/ldap.properties, /conf/saml-nameid.properties, /conf/services.properties, /conf/admin/admin.properties, /conf/authn/authn.properties, /conf/authn/duo.properties, /conf/c14n/subject-c14n.properties, /credentials/secrets.properties
+idp.additionalProperties = /conf/ldap.properties, /conf/saml-nameid.properties, /conf/services.properties, /conf/admin/admin.properties, /conf/authn/authn.properties, /conf/c14n/subject-c14n.properties, /conf/oidc.properties, /credentials/secrets.properties
# In most cases (and unless noted in the surrounding comments) the
# commented settings in the distributed files document default behavior.
diff --git a/idp-conf/src/test/resources/conf/oidc-clientinfo-resolvers.xml b/idp-conf/src/test/resources/conf/oidc-clientinfo-resolvers.xml
new file mode 100644
index 000000000..ec066f823
--- /dev/null
+++ b/idp-conf/src/test/resources/conf/oidc-clientinfo-resolvers.xml
@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:context="http://www.springframework.org/schema/context"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:c="http://www.springframework.org/schema/c"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+
+ default-init-method="initialize"
+ default-destroy-method="destroy"
+ default-lazy-init="true">
+
+ <!--
+ The following example contains two OIDC client information resolvers:
+ - first one reading a single client's information from a JSON file
+ - second one fetching client information from a configured StorageService
+ -->
+
+ <util:list id="shibboleth.oidc.ClientInformationResolvers">
+ <!-- <ref bean="ExampleFileResolver" /> -->
+ <ref bean="ExampleStorageClientInformationResolver" />
+ </util:list>
+
+ <!--
+ <bean id="ExampleFileResolver" parent="shibboleth.oidc.FilesystemClientInformationResolver"
+ c:metadata="%{idp.home}/metadata/oidc-client.json" />
+ -->
+
+ <bean id="ExampleStorageClientInformationResolver" parent="shibboleth.oidc.StorageClientInformationResolver"
+ p:storageService-ref="shibboleth.StorageService" />
+
+</beans>
diff --git a/idp-conf/src/test/resources/conf/oidc-credentials.xml b/idp-conf/src/test/resources/conf/oidc-credentials.xml
new file mode 100644
index 000000000..b08896ca1
--- /dev/null
+++ b/idp-conf/src/test/resources/conf/oidc-credentials.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:context="http://www.springframework.org/schema/context"
+ xmlns:util="http://www.springframework.org/schema/util" xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:c="http://www.springframework.org/schema/c" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+
+ default-init-method="initialize" default-destroy-method="destroy">
+
+ <!--
+ This file contains default OIDC signing credentials. This file should be imported into credentials.xml.
+ -->
+
+ <bean id="shibboleth.oidc.DefaultRSSigningCredential" parent="shibboleth.JWKCredential"
+ p:resource="%{idp.signing.oidc.rs.key}" />
+
+ <bean id="shibboleth.oidc.DefaultESSigningCredential" parent="shibboleth.JWKCredential"
+ p:resource="%{idp.signing.oidc.es.key}" />
+
+ <bean id="shibboleth.oidc.DefaultRSAEncryptionCredential" parent="shibboleth.JWKCredential"
+ p:resource="%{idp.signing.oidc.rsa.enc.key}" />
+
+ <!--
+ Lists ALL of your OP's response signing credentials for the default security configuration.
+ If you define additional signing credentials make sure to include them within this list.
+ -->
+ <util:list id="shibboleth.oidc.SigningCredentials">
+ <ref bean="shibboleth.oidc.DefaultRSSigningCredential" />
+ <ref bean="shibboleth.oidc.DefaultESSigningCredential" />
+ </util:list>
+
+ <!--
+ Lists ALL of your OP's request decryption credentials for the default security configuration.
+ If you define additional decryption credentials make sure to include them within this list.
+ -->
+ <util:list id="shibboleth.oidc.EncryptionCredentials">
+ <ref bean="shibboleth.oidc.DefaultRSAEncryptionCredential" />
+ </util:list>
+
+ <!--
+ If you need to publish a key set different from shibboleth.oidc.EncryptionCredentials, define
+ a list bean named "shibboleth.oidc.EncryptionCredentialsToPublish".
+ -->
+
+ <!-- Example of two active encryption credentials, but only publishing the second before removing from use. -->
+ <!--
+ <util:list id="shibboleth.oidc.EncryptionCredentialsToPublish">
+ <ref bean="shibboleth.oidc.OnlyNewDefaultRSAEncryptionCredential" />
+ </util:list>
+ -->
+
+ <!--
+ If you need to publish a key set different from shibboleth.oidc.SigningCredentials, define
+ a list bean named "shibboleth.oidc.SigningCredentialsToPublish".
+ -->
+
+ <!-- Example of publishing two signing credentials, before active use. -->
+ <!--
+ <util:list id="shibboleth.oidc.SigningCredentialsToPublish">
+ <ref bean="shibboleth.oidc.DefaultRSSigningCredential" />
+ <ref bean="shibboleth.oidc.DefaultESSigningCredential" />
+ <ref bean="shibboleth.oidc.UpcomingDefaultRSSigningCredential" />
+ </util:list>
+ -->
+
+</beans>
diff --git a/idp-conf/src/test/resources/conf/oidc.properties b/idp-conf/src/test/resources/conf/oidc.properties
new file mode 100644
index 000000000..990fcb3ec
--- /dev/null
+++ b/idp-conf/src/test/resources/conf/oidc.properties
@@ -0,0 +1,83 @@
+# Set the Open ID Connect Issuer value
+idp.oidc.issuer = https://your.issuer.example.org
+
+#Dynamic registration properties
+# The validity of registration before a new one is required.
+#idp.oidc.dynreg.defaultRegistrationValidity = PT24H
+# The validity of client secret registered
+#idp.oidc.dynreg.defaultSecretExpiration = P12M
+# The default scopes accepted in dynamic registration
+#idp.oidc.dynreg.defaultScope = openid profile email address phone offline_access
+# The default subject type if not set by client in request. Maybe set to pairwise or public.
+#idp.oidc.dynreg.defaultSubjectType = public
+# The acceptable client authentication methods when using dynamic registration
+#idp.oidc.dynreg.tokenEndpointAuthMethods = client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt
+# Regardless of what signing algorithms are configured, allow none for request object signing
+#idp.oidc.dynreg.allowNoneForRequestSigning = true
+# Bean to determine whether dynamic registration should validate the remote JWK set if it's defined in the request
+#idp.oidc.dynreg.validateRemoteJwks = shibboleth.Conditions.TRUE
+
+# Storage for storing remote jwk sets.
+#idp.oidc.jwk.StorageService = shibboleth.StorageService
+
+#Authorization/Token endpoint properties
+# The acceptable client authentication methods
+#idp.oidc.tokenEndpointAuthMethods = client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt
+
+# Default lifetime of oidc tokens
+#idp.oidc.authorizeCode.defaultLifetime = PT5M
+#idp.oidc.accessToken.defaultLifetime = PT10M
+#idp.oidc.refreshToken.defaultLifetime = PT2H
+#idp.oidc.idToken.defaultLifetime = PT1H
+
+# Lifetime of entries in revocation cache for authorize code
+#idp.oidc.revocationCache.authorizeCode.lifetime = PT6H
+# Storage for revocation cache. Requires server-side storage
+#idp.oidc.revocationCache.StorageService = shibboleth.StorageService
+
+# Signing keys for id tokens / userinfo response
+idp.signing.oidc.rs.key = %{idp.home}/credentials/idp-signing-rs.jwk
+idp.signing.oidc.es.key = %{idp.home}/credentials/idp-signing-es.jwk
+# Request object decryption key
+idp.signing.oidc.rsa.enc.key = %{idp.home}/credentials/idp-encryption-rsa.jwk
+
+#PKCE/AppAuth related properties
+#idp.oidc.forcePKCE = false
+#idp.oidc.allowPKCEPlain = false
+
+# Store user consent to authorization code & access/refresh tokens instead of exploiting consent storage
+#idp.oidc.encodeConsentInTokens = false
+
+# shibboleth.ClientInformationResolverService properties
+#idp.service.clientinfo.failFast = false
+#idp.service.clientinfo.checkInterval = PT0S
+#idp.service.clientinfo.resources = shibboleth.ClientInformationResolverResources
+
+# Special claim handling rules
+# "Encoded" attributes are encrypted and embedded into the access token
+#idp.oidc.encodedAttributes =
+# "Always included" attributes are forced into ID tokens for all response_types
+#idp.oidc.alwaysIncludedAttributes =
+# "Denied" attributes are omitted from the UserInfo token
+#idp.oidc.deniedUserInfoAttributes =
+
+# The source attribute used in generating the sub claim
+idp.oidc.subject.sourceAttribute = uid
+
+# The digest algorithm used in generating the sub claim
+#idp.oidc.subject.algorithm = SHA
+
+# The salt used in generating the subject
+# Do *NOT* share the salt with other people, it's like divulging your private key.
+# It is suggested you move this property into credentials/secrets.properties
+idp.oidc.subject.salt = this_too_should_be_ch4ng3d
+
+# Bean to determine whether SAML metadata should be exploited for trusted OIDC RP resolution
+#idp.oidc.metadata.saml = shibboleth.Conditions.TRUE
+
+# Upgrade interval to the remote JWKs
+#idp.oidc.jwksuri.fetchInterval = PT30M
+
+# Lower bound on the next file refresh from the time calculated based on the previous attempt for OP's own metadata (configuration-flow).
+#idp.oidc.config.minRefreshDelay = PT5M
+#idp.oidc.config.maxRefreshDelay = PT4H
\ No newline at end of file
diff --git a/idp-conf/src/test/resources/conf/relying-party.xml b/idp-conf/src/test/resources/conf/relying-party.xml
index f46789624..e3037a93f 100644
--- a/idp-conf/src/test/resources/conf/relying-party.xml
+++ b/idp-conf/src/test/resources/conf/relying-party.xml
@@ -23,7 +23,8 @@
<bean id="shibboleth.UnverifiedRelyingParty" parent="RelyingParty">
<property name="profileConfigurations">
<list>
- <!-- <bean parent="SAML2.SSO" p:encryptAssertions="false" /> -->
+<!-- <ref bean="OIDC.Configuration" /> -->
+<!-- <ref bean="OIDC.Keyset" /> -->
</list>
</property>
</bean>
@@ -43,6 +44,10 @@
<ref bean="SAML2.Logout.MDDriven" />
<ref bean="SAML2.AttributeQuery.MDDriven" />
<ref bean="SAML2.ArtifactResolution.MDDriven" />
+<!-- <ref bean="OIDC.SSO" /> -->
+<!-- <ref bean="OIDC.UserInfo"/> -->
+<!-- <ref bean="OAUTH2.Revocation"/> -->
+<!-- <ref bean="OAUTH2.Introspection" /> -->
</list>
</property>
</bean>
diff --git a/idp-conf/src/test/resources/credentials/idp-encryption-rsa.jwk b/idp-conf/src/test/resources/credentials/idp-encryption-rsa.jwk
new file mode 100644
index 000000000..0c211105d
--- /dev/null
+++ b/idp-conf/src/test/resources/credentials/idp-encryption-rsa.jwk
@@ -0,0 +1,13 @@
+{
+ "p": "5wVHO2-yeyReB-w_pUr-xzrY6tMS54rGlyUjOPiuUJxJYEHHOr1CqzuW1dUMkZDuec8ggF_rNd51hu6UChKsW6WLfLjSwVPx_ompBMmYVShv8PgtnwYL1d9PMqk2ibB_GaRLlM16e9ynqFaZXBNnbwl3qHv6WYu6nABPI54zoGs",
+ "kty": "RSA",
+ "q": "yzwGoBHkLWLqIQ_DdY2jimOEqgKrzPau41wHAMQXcyzGavayCgsc6r6o9_RDKkgwFnpXk-mmcZr-osqapRwL8LaYtoBBMXTRCFd02N1IqkxmXRjq3pu7WFSNsHWy0GkSdE626fpJklUjh4TLFfOSBRkzKy7E6cj-vyhzqmrgZAU",
+ "d": "bPsmY1pD0Wr5nj_Optd6hkoM5ANXKVeM2rMKQ2_n7qg6qA4Li-nb_jgyAaiomB2TYAjtJvY804Cc9lhsoXyN0o8NJh8YpI4_59oKJA-L_CupmeZxI9Jo7D4WCrh2HVIjCokqyDjd30aYdb_R9x1ACmE6cfwTxY0TVAhFaT9rhCVZHc6I8niw9kbevmpMZbLwR6WDvdivPBto6BGLXzInxf2s22lGcetP1m2Trj15hW5oOsUDTKXosKWZrs6-9qGO9Uq4JEzhdVdUOQvkoujrT-G9-hbscvDO2-KXJ6a3qz4SDYFCGoWB0QhsLmHGLtBOUvJRiEuztjAy-L_eyigLWQ",
+ "e": "AQAB",
+ "use": "enc",
+ "kid": "defaultRSAEnc",
+ "qi": "X8a2QwIr5q94V9QyAsArVijyICSrEsdT5Zfpyoz7Eyhd2VoAyA74WiUbcFElbHNbJOKmvHzp9les4o3BCpsTYwUyRdlB-npL_tEpp7fdIj8I3EhWfspJwT1EfLtJakGwoa6v0KpOmEzzR9mCwKmSnKfhF3aA1S-Hch1eEiV8qm8",
+ "dp": "vJNaafHrRwmQl_cInOxyvD4VAtn4_HgTUx1FeyPDZpmsa55F-nSzDwM9RJ77-3bKszOX3DJv1TEZzmLBBNfpSYYALnbP0m-rgZLtHLNSXXD8rz5mPwC4eIQoKbpmgk5H8a5i47w21xRu5sKJvNc5_zFDM4y_9ohQczbtYq2ohrE",
+ "dq": "fyfzTTtkdDErI7xlIquX4wIZAvXg38CH86CkkQofUeR10H7BLh993DGmLl0ZmN7Jl4a8PMM3bGT5ZIk28I73uYfFTIo6P-NC1eFCLl1lFYfvk9f_O4BcWwusCvfZBSR4c2S8dPAwD-pM7IFdP0LB3YbCyQXeFhe3q4p3s-xisLE",
+ "n": "t2das2ad4qJFs9irOR6s4xYF6rCGZb1KkTZqu-C0enTFWDr6CZFCN645esS2n20-wbPzMZTcOxFTJN4vRwzEpz2t4DKwNmxMX8CXBmujY0EO-oY9888zoKy4M17KtJuWxcBw3djmcuy3srHsExx3Fj9IsYh2SO8vBBEFsj0MajeYi9xhZJv1pqg3HPrEptclIAEcjuIV2QtwJ3MtSPrmXuLV0WfGbJOVEZNS1JsqYLwMOpgnIBp2P2B_Iba4GwI_9FBpQJ486Szmcnf-8khzJwLmawDvIfrwyEspVF48EHgGLfwLOejAivYJKbEIaUtHDEm8fEx_zUJOp9sk7UvuFw"
+}
diff --git a/idp-conf/src/test/resources/credentials/idp-signing-es.jwk b/idp-conf/src/test/resources/credentials/idp-signing-es.jwk
new file mode 100644
index 000000000..1922fdd0d
--- /dev/null
+++ b/idp-conf/src/test/resources/credentials/idp-signing-es.jwk
@@ -0,0 +1,9 @@
+{
+ "kty": "EC",
+ "d": "QWtFyZCtU1LV6P6WRS-mDusOW1kiAT7IgedxGLn67fU",
+ "use": "sig",
+ "crv": "P-256",
+ "kid": "defaultECSign",
+ "x": "PwvfwhB26DLjKcq5P0jdsKINNb6rjO8H8TWpSfLzmP8",
+ "y": "mlPDVWMGI6srvnsOpRrXHKzwxgQF-yA9R-ZdAeAEyGk"
+}
diff --git a/idp-conf/src/test/resources/credentials/idp-signing-rs.jwk b/idp-conf/src/test/resources/credentials/idp-signing-rs.jwk
new file mode 100644
index 000000000..c8ebcdc31
--- /dev/null
+++ b/idp-conf/src/test/resources/credentials/idp-signing-rs.jwk
@@ -0,0 +1,13 @@
+{
+ "p": "3uZuwfDlEJ0CvznRR_jVoF6iNMgz-wvcCX9hxpuz9eT0DtkbBwOz-EtCLcR7yaykWLHVlYscq3SyyTQg91vJ8H4CW_UzKra5yc1FUAKZ3BHgz-EaNBYvvqCXXal29eJWGHlMU6RnUv_OItQaj2tsv9cAYF-vjh9Pf2gfQNAsZ5E",
+ "kty": "RSA",
+ "q": "pKkqFLDZjLMBmRh6HoqFuk3NqihoEvT9z-W0OpwTFWELNgSldNtmJ_RMnxxryiaepnwID6y2ghcXy-lobQnuvABG6RW0yDOBpr3Cl2GQNeBaQ4ubLiEY85NnDl0EmVnG7VqgSVS-HE0w9n4MfRKWRCRfIOSrA-_PdT18qmJ5Zgc",
+ "d": "Pejya5O-L57ePGM1g386iUSrLQf9rs52hD4R9pXGhPNlFlqn3XO20IPwxmtBK5UtoRqfrS4q3xT-eMwlcQILGzMeEKNdORb68QR4wxEVgCS44eQizXwn3M-Hgw4a7QXAb7gCOoFKeRKrxCm4AB9pZYe8Xqj5Em9_b6WZclOUYK-MLpucRjBmOSV-XhhfYYQkrnF3yzPg3lmLEAiaxHhMwzBYm25qpfTsZ2N879O2TKMYKuid5WeyGtjXhoTf5nBDYMCDFQs1K-_IW-HD47DREs6aiUMLpI42N01xWsPqxBcrFm5h_SjJ71YOBpla_GkcdvYyp4gqx__mSy7-LQqQgQ",
+ "e": "AQAB",
+ "use": "sig",
+ "kid": "defaultRSASign",
+ "qi": "iwkNSyRS2Q8d5sRQWRxE_3F8DD2uQ6BJD9sWZL1DxMdIscrHho-AeUepwES_6rN3G3ep6tyaRW_6dKFOc-2v1GcOuB6t5b4zuhBiujZWUtr368Frz2iaC_bLlDSPSU3bJn_tGHU0aFAyoZZYjrg-SUDk4GEjZhnhEst1O81HMHw",
+ "dp": "F6GOdHk5j71VoThb-6lh3JKr17Sx7hefyFH857VyKsuPJFPYDbJSziwMZBXEmej3s3-HCUeqTnMc0T_5jr_odNqnHWCtgAXHRKHCi2z7Kt2qW9-di5Ael7Mm2QMyXXcVcZrKgMOZQK9mB0M9XZ8h9GSy4YTDc-nV38gGKDTpwEE",
+ "dq": "cV2qhD5SOaWQ5xfMFDTo5yDkBU_2f36_NKCAmo2UMfbzYgiG5dKcHcv76NwHdlFqj1L7tdcCfMRrdM_JPrFE9Zj3OUjhg6i6jdM-Iz1frUg-vRxkBblx1VlZ7bCrFu2RoR7xFivLC-81U6_q5z2hyV6FRD9LYtV7rstbhm9wB4c",
+ "n": "j17pty6DFoQNIMJlcpCABcg-r4USeqDGvt_jh4F5tem6sBFaInqzlP5PoCZHWAUmKIcwhUgK1IrHWjrRn3UE7qbkEF40AAm71G3xO5x_9PKoUHIX9-Kqy8gG02-uU00VprPZ0A1cU3x6zA23Efpee_nLKD-bzUaJ_z_fy7lJBW7L8qqO7pGbDAZwc8oOkUiFuC4SpwuJl0njCLSyIUNGI8cAXk3M2qXHyCaFjd5n8AETySxst6Pq4eYtC46WnTqNvw3av7Nk2Y9jekwJKfN5ykfu6f2v3NdkyJjuuQ-Z33bcDNGD7hAdRfoLpjzrCcpcFwqh657exSY_1BSj2AOa9w"
+}
diff --git a/idp-conf/src/test/resources/metadata/example-metadata.xml b/idp-conf/src/test/resources/metadata/example-metadata.xml
index 94e2de5cb..b47d54dae 100644
--- a/idp-conf/src/test/resources/metadata/example-metadata.xml
+++ b/idp-conf/src/test/resources/metadata/example-metadata.xml
@@ -137,14 +137,8 @@ h+XNZ5oAql/cjrwDWw==
</SPSSODescriptor>
<SPSSODescriptor protocolSupportEnumeration="http://openid.net/specs/openid-connect-core-1_0.html">
<Extensions>
- <oidcmd:OAuthRPExtensions>
- <oidcmd:GrantType>authorization_code</oidcmd:GrantType>
- <oidcmd:ResponseType>code</oidcmd:ResponseType>
- <oidcmd:ApplicationType>web</oidcmd:ApplicationType>
- <oidcmd:TokenEndpointAuthMethod>client_secret_basic</oidcmd:TokenEndpointAuthMethod>
- <oidcmd:Scope>openid</oidcmd:Scope>
- <oidcmd:Scope>profile</oidcmd:Scope>
- </oidcmd:OAuthRPExtensions>
+ <oidcmd:OAuthRPExtensions application_type="web" grant_types="authorization_code" response_types="code"
+ token_endpoint_auth_method="client_secret_basic" scopes="openid profile" />
</Extensions>
<KeyDescriptor>
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
diff --git a/idp-conf/src/test/resources/static/openid-configuration.json b/idp-conf/src/test/resources/static/openid-configuration.json
new file mode 100644
index 000000000..ead5ccd04
--- /dev/null
+++ b/idp-conf/src/test/resources/static/openid-configuration.json
@@ -0,0 +1,137 @@
+{
+ "issuer":"https://idp.example.org",
+ "authorization_endpoint":"https://idp.example.org:8443/idp/profile/oidc/authorize",
+ "registration_endpoint":"https://idp.example.org:8443/idp/profile/oidc/register",
+ "token_endpoint":"https://idp.example.org:8443/idp/profile/oidc/token",
+ "userinfo_endpoint":"https://idp.example.org:8443/idp/profile/oidc/userinfo",
+ "jwks_uri":"https://idp.example.org:8443/idp/profile/oidc/keyset",
+ "response_types_supported":[
+ "code",
+ "id_token",
+ "token id_token",
+ "code id_token",
+ "code token",
+ "code token id_token"
+ ],
+ "subject_types_supported":[
+ "public",
+ "pairwise"
+ ],
+ "grant_types_supported":[
+ "authorization_code",
+ "implicit",
+ "refresh_token"
+ ],
+ "id_token_encryption_alg_values_supported":[
+ "RSA1_5",
+ "RSA-OAEP",
+ "RSA-OAEP-256",
+ "A128KW",
+ "A192KW",
+ "A256KW",
+ "A128GCMKW",
+ "A192GCMKW",
+ "A256GCMKW"
+ ],
+ "id_token_encryption_enc_values_supported":[
+ "A128CBC-HS256"
+ ],
+ "id_token_signing_alg_values_supported":[
+ "RS256",
+ "RS384",
+ "RS512",
+ "HS256",
+ "HS384",
+ "HS512",
+ "ES256"
+ ],
+ "userinfo_encryption_alg_values_supported":[
+ "RSA1_5",
+ "RSA-OAEP",
+ "RSA-OAEP-256",
+ "A128KW",
+ "A192KW",
+ "A256KW",
+ "A128GCMKW",
+ "A192GCMKW",
+ "A256GCMKW"
+ ],
+ "userinfo_encryption_enc_values_supported":[
+ "A128CBC-HS256"
+ ],
+ "userinfo_signing_alg_values_supported":[
+ "RS256",
+ "RS384",
+ "RS512",
+ "HS256",
+ "HS384",
+ "HS512",
+ "ES256"
+ ],
+ "request_object_signing_alg_values_supported":[
+ "none",
+ "RS256",
+ "RS384",
+ "RS512",
+ "HS256",
+ "HS384",
+ "HS512",
+ "ES256",
+ "ES384",
+ "ES512"
+ ],
+ "token_endpoint_auth_methods_supported":[
+ "client_secret_basic",
+ "client_secret_post",
+ "client_secret_jwt",
+ "private_key_jwt"
+ ],
+ "claims_parameter_supported":true,
+ "request_parameter_supported":true,
+ "request_uri_parameter_supported":true,
+ "require_request_uri_registration":false,
+ "display_values_supported":[
+ "page"
+ ],
+ "scopes_supported":[
+ "openid",
+ "profile",
+ "email",
+ "address",
+ "phone",
+ "offline_access"
+ ],
+ "response_modes_supported":[
+ "query",
+ "fragment",
+ "form_post"
+ ],
+ "claims_supported":[
+ "aud",
+ "iss",
+ "sub",
+ "iat",
+ "exp",
+ "acr",
+ "auth_time",
+ "email",
+ "email_verified",
+ "address",
+ "phone",
+ "phone_number_verified",
+ "name",
+ "family_name",
+ "given_name",
+ "middle_name",
+ "nickname",
+ "preferred_username",
+ "profile",
+ "picture",
+ "website",
+ "gender",
+ "birthdate",
+ "zoneinfo",
+ "locale",
+ "updated_at"
+ ]
+}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list