[java-idp-oidc] branch main updated: JOIDC-89 - Inbound and outbound interceptor flows are not wired to the OIDC flows
Henri Mikkonen
henri.mikkonen at iki.fi
Mon Apr 11 16:36:24 UTC 2022
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=8975cc3b42d5b198683c88b055aa44fe2f445e32
The following commit(s) were added to refs/heads/main by this push:
new 8975cc3b JOIDC-89 - Inbound and outbound interceptor flows are not wired to the OIDC flows
8975cc3b is described below
commit 8975cc3b42d5b198683c88b055aa44fe2f445e32
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Mon Apr 11 19:33:43 2022 +0300
JOIDC-89 - Inbound and outbound interceptor flows are not wired to the OIDC flows
https://shibboleth.atlassian.net/browse/JOIDC-89
Both inbound and outbound interceptor flows are now wired for all the OAuth2 and OIDC
flows.
---
.../flows/oauth2/introspection/introspection-flow.xml | 5 +++--
.../idp/flows/oauth2/revocation/revocation-flow.xml | 5 +++--
.../abstract-api-info/oidc-abstract-api-info-flow.xml | 13 ++++++++++++-
.../flows/oidc/abstract-api/oidc-abstract-api-flow.xml | 10 ++++++++++
.../idp/flows/oidc/abstract/oidc-abstract-beans.xml | 18 ++++++++++++++++++
.../idp/flows/oidc/abstract/oidc-abstract-flow.xml | 18 ++++++++++++++++++
.../idp/flows/oidc/authorize/authorize-flow.xml | 17 ++++++++++++++---
.../idp/flows/oidc/register/register-flow.xml | 15 +++++++++++++--
.../net/shibboleth/idp/flows/oidc/token/token-flow.xml | 7 ++++---
.../idp/flows/oidc/userinfo/userinfo-flow.xml | 15 +++++++++++++--
10 files changed, 108 insertions(+), 15 deletions(-)
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/introspection/introspection-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/introspection/introspection-flow.xml
index 5bd77f7e..1bde90be 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/introspection/introspection-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/introspection/introspection-flow.xml
@@ -26,9 +26,10 @@
<evaluate expression="SelectRelyingPartyConfiguration" />
<evaluate expression="SelectProfileConfiguration" />
<evaluate expression="PostLookupPopulateAuditContext" />
+ <evaluate expression="PopulateInboundInterceptContext" />
<evaluate expression="'proceed'" />
- <transition on="proceed" to="AuthenticationSetup" />
+ <transition on="proceed" to="CheckInboundInterceptContext" />
</action-state>
<!-- Authentication subflow happens here. -->
@@ -37,7 +38,7 @@
<evaluate expression="ProcessTokenForIntrospection" />
<evaluate expression="'proceed'" />
- <transition on="proceed" to="BuildResponseMessage" />
+ <transition on="proceed" to="PopulateOutboundInterceptContext" />
</action-state>
<bean-import resource="introspection-beans.xml" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/revocation/revocation-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/revocation/revocation-flow.xml
index 5ad69304..bd3acae3 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/revocation/revocation-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/revocation/revocation-flow.xml
@@ -26,9 +26,10 @@
<evaluate expression="SelectRelyingPartyConfiguration" />
<evaluate expression="SelectProfileConfiguration" />
<evaluate expression="PostLookupPopulateAuditContext" />
+ <evaluate expression="PopulateInboundInterceptContext" />
<evaluate expression="'proceed'" />
- <transition on="proceed" to="AuthenticationSetup" />
+ <transition on="proceed" to="CheckInboundInterceptContext" />
</action-state>
<!-- Authentication subflow happens here. -->
@@ -38,7 +39,7 @@
<evaluate expression="RevokeToken" />
<evaluate expression="'proceed'" />
- <transition on="proceed" to="BuildResponseMessage" />
+ <transition on="proceed" to="PopulateOutboundInterceptContext" />
</action-state>
<bean-import resource="revocation-beans.xml" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract-api-info/oidc-abstract-api-info-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract-api-info/oidc-abstract-api-info-flow.xml
index 61d064c6..102048ab 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract-api-info/oidc-abstract-api-info-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract-api-info/oidc-abstract-api-info-flow.xml
@@ -11,10 +11,21 @@
<evaluate expression="InitializeRelyingPartyContext" />
<evaluate expression="SelectRelyingPartyConfiguration" />
<evaluate expression="SelectProfileConfiguration" />
+ <evaluate expression="PopulateInboundInterceptContext" />
<evaluate expression="'proceed'" />
- <transition on="proceed" to="BuildResponseMessage" />
+ <transition on="proceed" to="CheckInboundInterceptContext" />
</action-state>
+ <decision-state id="CheckInboundInterceptContext">
+ <if test="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.profile.context.ProfileInterceptorContext)).getAvailableFlows().isEmpty()"
+ then="PopulateOutboundInterceptContext" else="DoInboundInterceptSubflow" />
+ </decision-state>
+
+ <subflow-state id="DoInboundInterceptSubflow" subflow="intercept">
+ <input name="calledAsSubflow" value="true" />
+ <transition on="proceed" to="PopulateOutboundInterceptContext" />
+ </subflow-state>
+
<bean-import resource="../abstract-api-info/oidc-abstract-api-info-beans.xml" />
</flow>
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract-api/oidc-abstract-api-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract-api/oidc-abstract-api-flow.xml
index a368ac53..7a24816f 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract-api/oidc-abstract-api-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract-api/oidc-abstract-api-flow.xml
@@ -5,6 +5,16 @@
abstract="true">
<!-- Actions common to most OIDC profile backend flows. -->
+
+ <decision-state id="CheckInboundInterceptContext">
+ <if test="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.profile.context.ProfileInterceptorContext)).getAvailableFlows().isEmpty()"
+ then="AuthenticationSetup" else="DoInboundInterceptSubflow" />
+ </decision-state>
+
+ <subflow-state id="DoInboundInterceptSubflow" subflow="intercept">
+ <input name="calledAsSubflow" value="true" />
+ <transition on="proceed" to="AuthenticationSetup" />
+ </subflow-state>
<action-state id="AuthenticationSetup">
<evaluate expression="InitializeAuthenticationContext" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml
index 61d72229..f2b30adc 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml
@@ -30,6 +30,15 @@
<bean id="SelectProfileConfiguration" class="net.shibboleth.idp.profile.impl.SelectProfileConfiguration"
scope="prototype" />
+ <bean id="PopulateInboundInterceptContext"
+ class="net.shibboleth.idp.profile.interceptor.impl.PopulateProfileInterceptorContext" scope="prototype"
+ p:availableFlows="#{@'shibboleth.ProfileInterceptorFlowDescriptorManager'.getComponents()}"
+ p:loggingLabel="inbound">
+ <property name="activeFlowsLookupStrategy">
+ <bean class="net.shibboleth.idp.profile.config.navigate.InboundFlowsLookupFunction" />
+ </property>
+ </bean>
+
<bean id="ResolveAttributes" class="net.shibboleth.idp.profile.impl.ResolveAttributes" scope="prototype"
c:resolverService-ref="shibboleth.AttributeResolverService"
p:transcoderRegistry-ref="shibboleth.AttributeRegistryService"
@@ -39,6 +48,15 @@
c:filterService-ref="shibboleth.AttributeFilterService"
p:maskFailures="%{idp.service.attribute.filter.maskFailures:true}" />
+ <bean id="PopulateOutboundInterceptContext"
+ class="net.shibboleth.idp.profile.interceptor.impl.PopulateProfileInterceptorContext" scope="prototype"
+ p:availableFlows="#{@'shibboleth.ProfileInterceptorFlowDescriptorManager'.getComponents()}"
+ p:loggingLabel="outbound">
+ <property name="activeFlowsLookupStrategy">
+ <bean class="net.shibboleth.idp.profile.config.navigate.OutboundFlowsLookupFunction" />
+ </property>
+ </bean>
+
<bean id="oidc.messageEncoderFactory"
class="net.shibboleth.idp.plugin.oidc.op.encoding.impl.OIDCResponseEncoderFactory"
p:messageEncoder-ref="oidc.nimbusEncoder" scope="prototype" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-flow.xml
index 52959894..07478cf5 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-flow.xml
@@ -3,6 +3,24 @@
xsi:schemaLocation="http://www.springframework.org/schema/webflow http://www.springframework.org/schema/webflow/spring-webflow.xsd"
abstract="true">
+ <action-state id="PopulateOutboundInterceptContext">
+ <evaluate expression="PopulateOutboundInterceptContext" />
+ <evaluate expression="'proceed'" />
+ <transition on="proceed" to="CheckOutboundInterceptContext" />
+ </action-state>
+
+ <decision-state id="CheckOutboundInterceptContext">
+ <if test="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.profile.context.ProfileInterceptorContext)).getAvailableFlows().isEmpty()"
+ then="BuildResponseMessage" else="DoOutboundInterceptSubflow" />
+ </decision-state>
+
+ <subflow-state id="DoOutboundInterceptSubflow" subflow="intercept">
+ <input name="calledAsSubflow" value="true" />
+ <transition on="proceed" to="BuildResponseMessage" />
+ <transition to="HandleError" />
+ </subflow-state>
+
+
<!-- Actions common to most OIDC profile flows. -->
<action-state id="BuildResponseMessage">
<evaluate expression="FormOutboundMessage" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-flow.xml
index 9537598e..45b92e20 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-flow.xml
@@ -23,11 +23,22 @@
<evaluate expression="SelectRelyingPartyConfiguration" />
<evaluate expression="SelectProfileConfiguration" />
<evaluate expression="PostLookupPopulateAuditContext" />
+ <evaluate expression="PopulateInboundInterceptContext" />
<evaluate expression="PopulateUserAgentContext" />
<evaluate expression="'proceed'" />
- <transition on="proceed" to="OutboundContextsAndSecurityParameters" />
+ <transition on="proceed" to="CheckInboundInterceptContext" />
</action-state>
+ <decision-state id="CheckInboundInterceptContext">
+ <if test="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.profile.context.ProfileInterceptorContext)).getAvailableFlows().isEmpty()"
+ then="OutboundContextsAndSecurityParameters" else="DoInboundInterceptSubflow" />
+ </decision-state>
+
+ <subflow-state id="DoInboundInterceptSubflow" subflow="intercept">
+ <input name="calledAsSubflow" value="true" />
+ <transition on="proceed" to="OutboundContextsAndSecurityParameters" />
+ </subflow-state>
+
<action-state id="OutboundContextsAndSecurityParameters">
<evaluate expression="InitializeOutboundMessageContext" />
<evaluate expression="SetRequestObjectToResponseContext" />
@@ -136,13 +147,13 @@
<evaluate expression="PopulateClientStorageSaveContext" />
<evaluate expression="'proceed'" />
<transition on="proceed" to="ClientStorageSave" />
- <transition on="NoSaveNeeded" to="BuildResponseMessage" />
+ <transition on="NoSaveNeeded" to="PopulateOutboundInterceptContext" />
<transition to="HandleError" />
</action-state>
<subflow-state id="ClientStorageSave" subflow="client-storage/write">
<input name="calledAsSubflow" value="true" />
- <transition on="proceed" to="BuildResponseMessage"/>
+ <transition on="proceed" to="PopulateOutboundInterceptContext"/>
<transition to="HandleError" />
</subflow-state>
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/register/register-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/register/register-flow.xml
index 98a8878e..22f1e438 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/register/register-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/register/register-flow.xml
@@ -19,11 +19,22 @@
<evaluate expression="ValidateRegistrationAccessToken" />
<evaluate expression="SelectRelyingPartyConfiguration" />
<evaluate expression="SelectProfileConfiguration" />
+ <evaluate expression="PopulateInboundInterceptContext" />
<evaluate expression="'proceed'" />
<transition on="proceed"
- to="OutboundContextsAndSecurityParameters" />
+ to="CheckInboundInterceptContext" />
</action-state>
+ <decision-state id="CheckInboundInterceptContext">
+ <if test="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.profile.context.ProfileInterceptorContext)).getAvailableFlows().isEmpty()"
+ then="OutboundContextsAndSecurityParameters" else="DoInboundInterceptSubflow" />
+ </decision-state>
+
+ <subflow-state id="DoInboundInterceptSubflow" subflow="intercept">
+ <input name="calledAsSubflow" value="true" />
+ <transition on="proceed" to="OutboundContextsAndSecurityParameters" />
+ </subflow-state>
+
<action-state id="OutboundContextsAndSecurityParameters">
<evaluate expression="InitializeRegistrationMetadataPolicyContext" />
<evaluate expression="ValidateRegistrationRequestMetadata" />
@@ -52,7 +63,7 @@
<evaluate expression="AddRequestObjectSecurityConfigurationToClientMetadata" />
<evaluate expression="AddRemainingClaimsToClientMetadata" />
<evaluate expression="'proceed'" />
- <transition on="proceed" to="BuildResponseMessage" />
+ <transition on="proceed" to="PopulateOutboundInterceptContext" />
</action-state>
<action-state id="BuildResponseMessage">
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-flow.xml
index 72022bdc..0f6afca5 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-flow.xml
@@ -26,9 +26,10 @@
<evaluate expression="SelectProfileConfiguration" />
<evaluate expression="PostLookupPopulateAuditContext" />
<evaluate expression="PopulateTokenEndpointJwtSignatureValidationParameters"/>
+ <evaluate expression="PopulateInboundInterceptContext" />
<evaluate expression="'proceed'" />
- <transition on="proceed" to="AuthenticationSetup" />
+ <transition on="proceed" to="CheckInboundInterceptContext" />
</action-state>
<!-- Authentication subflow happens here. -->
@@ -158,7 +159,7 @@
<evaluate expression="EncryptIDToken" />
<evaluate expression="'proceed'" />
- <transition on="proceed" to="BuildResponseMessage" />
+ <transition on="proceed" to="PopulateOutboundInterceptContext" />
</action-state>
<decision-state id="CheckAttributeResolutionForAudience">
@@ -185,7 +186,7 @@
<evaluate expression="SetOAuthAccessTokenToResponseContext" />
<evaluate expression="'proceed'" />
- <transition on="proceed" to="BuildResponseMessage" />
+ <transition on="proceed" to="PopulateOutboundInterceptContext" />
</action-state>
<bean-import resource="token-beans.xml" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-flow.xml
index 02f6dc5e..e22cf7bb 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-flow.xml
@@ -27,11 +27,22 @@
<evaluate expression="SelectRelyingPartyConfiguration" />
<evaluate expression="SelectProfileConfiguration" />
<evaluate expression="PostLookupPopulateAuditContext" />
+ <evaluate expression="PopulateInboundInterceptContext" />
<evaluate expression="'proceed'" />
- <transition on="proceed" to="OutboundContextsAndSecurityParameters" />
+ <transition on="proceed" to="CheckInboundInterceptContext" />
</action-state>
+ <decision-state id="CheckInboundInterceptContext">
+ <if test="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.profile.context.ProfileInterceptorContext)).getAvailableFlows().isEmpty()"
+ then="OutboundContextsAndSecurityParameters" else="DoInboundInterceptSubflow" />
+ </decision-state>
+
+ <subflow-state id="DoInboundInterceptSubflow" subflow="intercept">
+ <input name="calledAsSubflow" value="true" />
+ <transition on="proceed" to="OutboundContextsAndSecurityParameters" />
+ </subflow-state>
+
<action-state id="OutboundContextsAndSecurityParameters">
<evaluate expression="ValidateScope" />
<evaluate expression="SetRequestedClaimsToResponseContext" />
@@ -74,7 +85,7 @@
<evaluate expression="EncryptUserInfoResponse" />
<evaluate expression="'proceed'" />
- <transition on="proceed" to="BuildResponseMessage" />
+ <transition on="proceed" to="PopulateOutboundInterceptContext" />
</action-state>
<bean-import resource="userinfo-beans.xml" />
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list