[java-idp-plugin-oidc-rp] branch main updated: Minor improvements to ProviderMetadataResolver, update decryption config
Phil Smart
philip.smart at jisc.ac.uk
Thu Aug 4 15:13:32 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=b8f57cddb156e25223e8ffa93e1bb4d0603b36f9
The following commit(s) were added to refs/heads/main by this push:
new b8f57cd Minor improvements to ProviderMetadataResolver, update decryption config
b8f57cd is described below
commit b8f57cddb156e25223e8ffa93e1bb4d0603b36f9
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Thu Aug 4 16:13:25 2022 +0100
Minor improvements to ProviderMetadataResolver, update decryption config
---
...oviderMetadataEncryptionParametersResolver.java | 1 +
.../oidc-relying-party-authn-beans.xml | 1 -
.../oidc-relying-party-authn-flow.xml | 1 -
.../idp/service/relying-party/postconfig.xml | 91 +++++++++++-----------
.../plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java | 8 +-
5 files changed, 49 insertions(+), 53 deletions(-)
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ProviderMetadataEncryptionParametersResolver.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ProviderMetadataEncryptionParametersResolver.java
index b4fc384..87d7bd7 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ProviderMetadataEncryptionParametersResolver.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ProviderMetadataEncryptionParametersResolver.java
@@ -265,6 +265,7 @@ public class ProviderMetadataEncryptionParametersResolver extends BasicEncryptio
* @param params the encryption parameters to add the credential to
* @param encryptionMethod the encryption method to use
*/
+ //TODO what happens if a 'dir' alg is used and that matches a local cred?
private void resolveCredentialForSupportedAlgorithm(@Nonnull final OIDCProviderMetadata metadata,
@Nonnull final List<JWEAlgorithm> keyTransportAlgorithms,
@Nonnull final List<Credential> localCredentials,
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
index 3b2f0a3..b3c7b83 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
@@ -302,7 +302,6 @@
<!-- After authentication response -->
-
<bean id="ValidateExternalAuthenticationContext" scope="prototype"
class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.ValidateExternalAuthenticationContext" />
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-flow.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-flow.xml
index 917e5fd..dfecc48 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-flow.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-flow.xml
@@ -83,7 +83,6 @@
</view-state>
<action-state id="ValidateResponse">
- <!-- PopulateClientTLSValidationParameters? -->
<evaluate expression="ValidateExternalAuthenticationContext" />
<evaluate expression="ValidateAuthenticationResponseResult" />
<evaluate expression="ValidateResponseStateMatchesRequest" />
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index 6c9d816..c43f38c 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -40,18 +40,18 @@
<property name="forceAuthnPredicate">
<bean class="net.shibboleth.idp.saml.profile.config.logic.ProxyAwareForceAuthnPredicate" />
</property>
- <property name="defaultAuthenticationMethodsLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassLookupFunction"
- p:mappings="#{getObject('shibboleth.authn.oidc.rp.PrincipalProxyRequestMappings')}" />
+ <property name="defaultAuthenticationMethodsLookupStrategy">
+ <bean
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassLookupFunction"
+ p:mappings="#{getObject('shibboleth.authn.oidc.rp.PrincipalProxyRequestMappings')}" />
</property>
- </bean>
-
- <!-- TODO Move this out to its own file? -->
- <util:map id="shibboleth.authn.oidc.rp.PrincipalProxyRequestMappings">
+ </bean>
+
+ <!-- TODO Move this out to its own file? -->
+ <util:map id="shibboleth.authn.oidc.rp.PrincipalProxyRequestMappings">
<entry>
<key>
- <bean parent="shibboleth.SAML2AuthnContextClassRef"
- c:classRef="http://example.org/ac/classes/mfa" />
+ <bean parent="shibboleth.SAML2AuthnContextClassRef" c:classRef="http://example.org/ac/classes/mfa" />
</key>
<list>
<bean class="net.shibboleth.oidc.authn.principal.AuthenticationContextClassReferencePrincipal"
@@ -74,7 +74,8 @@
<ref
bean="#{'%{idp.authn.oidc.rp.idtoken.valid.config:shibboleth.authn.oidc.rp.DefaultJWTSignatureValidationConfiguration}'.trim()}" />
</property>
- <!-- User info config is actually the same by default as id_token, not sure we need seperation, although could be overriden -->
+ <!-- User info config is actually the same by default as id_token, not sure we need seperation, although could be
+ overriden -->
<property name="userInfoJwtDecryptionConfiguration">
<ref
bean="#{'%{idp.authn.oidc.rp.userinfotoken.decrypt.config:shibboleth.authn.oidc.rp.DefaultJWTDecryptionConfiguration}'.trim()}" />
@@ -89,10 +90,11 @@
</property>
<!-- For now, Request Object encryption configuration only -->
<property name="encryptionConfiguration">
- <ref bean="#{'%{idp.authn.oidc.rp.encryption.config:shibboleth.authn.oidc.rp.EncryptionConfiguration}'.trim()}" />
+ <ref
+ bean="#{'%{idp.authn.oidc.rp.encryption.config:shibboleth.authn.oidc.rp.EncryptionConfiguration}'.trim()}" />
</property>
</bean>
-
+
<!-- Configuration for supported algorithms for Request Object encryption. -->
<bean id="shibboleth.authn.oidc.rp.EncryptionConfiguration" parent="shibboleth.BasicEncryptionConfiguration"
p:keyTransportEncryptionCredentials="#{getObject('shibboleth.authn.oidc.rp.RequestObjectEncryptionCredentials')}">
@@ -113,7 +115,7 @@
<util:constant
static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_128_GCM_KW" />
<util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_192_GCM_KW" />
+ static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_192_GCM_KW" />
<util:constant
static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_256_GCM_KW" />
</list>
@@ -129,18 +131,16 @@
<util:constant
static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A128GCM" />
<util:constant
- static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A192GCM" />
+ static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A192GCM" />
<util:constant
static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A256GCM" />
</list>
</property>
</bean>
-
- <!--
- Configuration for credentials and supported algorithms for request object request signing.
- Any shared secret credential from the RP's configuration will be included in the set of usable credentials
- -->
- <bean id="shibboleth.authn.oidc.rp.DefaultRequestObjectSigningConfiguration"
+
+ <!-- Configuration for credentials and supported algorithms for request object request signing. Any shared secret credential
+ from the RP's configuration will be included in the set of usable credentials -->
+ <bean id="shibboleth.authn.oidc.rp.DefaultRequestObjectSigningConfiguration"
parent="shibboleth.BasicSignatureSigningConfiguration"
p:signingCredentials="#{getObject('shibboleth.authn.oidc.rp.SigningCredentials')}">
<property name="signatureAlgorithms">
@@ -160,44 +160,47 @@
</list>
</property>
</bean>
-
- <bean id="shibboleth.authn.oidc.rp.SigningCredentials"
+
+ <bean id="shibboleth.authn.oidc.rp.SigningCredentials"
class="net.shibboleth.idp.plugin.authn.oidc.rp.config.CredentialsListFactory"
- c:_0-ref="shibboleth.authn.oidc.rp.DefaultSigningCredentials"/>
-
- <bean id="shibboleth.authn.oidc.rp.RequestObjectEncryptionCredentials"
+ c:_0-ref="shibboleth.authn.oidc.rp.DefaultSigningCredentials" />
+
+ <bean id="shibboleth.authn.oidc.rp.RequestObjectEncryptionCredentials"
class="net.shibboleth.idp.plugin.authn.oidc.rp.config.CredentialsListFactory"
- c:_0-ref="shibboleth.authn.oidc.rp.DefaultRequestObjectEncryptionCredentials"/>
+ c:_0-ref="shibboleth.authn.oidc.rp.DefaultRequestObjectEncryptionCredentials" />
-
- <bean id="shibboleth.authn.oidc.rp.DefaultCredential"
- parent="shibboleth.authn.oidc.rp.ExpiringJWKCredential"
- p:secret="%{idp.authn.oidc.rp.client.clientSecret:#{null}}"
- p:keyNames="defaultPropertiesClientSecret"
+
+ <bean id="shibboleth.authn.oidc.rp.DefaultCredential" parent="shibboleth.authn.oidc.rp.ExpiringJWKCredential"
+ p:secret="%{idp.authn.oidc.rp.client.clientSecret:#{null}}" p:keyNames="defaultPropertiesClientSecret"
p:alg="dir" />
<bean id="shibboleth.authn.oidc.rp.DefaultJWTDecryptionConfiguration"
class="net.shibboleth.oidc.security.impl.BasicJWTDecryptionConfiguration"
p:KEKCredentialResolver-ref="defaultOIDCRPKeyEncryptionCredentialResolver"
- p:contentEncryptionKeyCredentialResolver-ref="defaultOIDCRPContentEncryptionKeyCredentialResolver"/>
+ p:contentEncryptionKeyCredentialResolver-ref="defaultOIDCRPContentEncryptionKeyCredentialResolver" />
- <!-- A resolver to public/private keys global to the RP -->
+ <!-- A resolver to public/private key encryption keys global to the RP -->
<bean id="defaultOIDCRPKeyEncryptionCredentialResolver"
class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
<constructor-arg>
- <list>
- <bean class="net.shibboleth.oidc.security.credential.impl.StaticJOSEObjectCredentialResolver"
- c:credentials-ref="shibboleth.authn.oidc.rp.DefaultKeyEncryptionCredentials" />
+ <list>
+ <bean class="net.shibboleth.oidc.security.credential.impl.LocalJOSEObjectCredentialResolver">
+ <constructor-arg name="localCredentialResolver">
+ <bean
+ class="net.shibboleth.oidc.security.credential.impl.CollectionJOSEObjectCredentialResolver"
+ c:credentials-ref="shibboleth.authn.oidc.rp.DefaultKeyEncryptionCredentials" />
+ </constructor-arg>
+ </bean>
</list>
</constructor-arg>
</bean>
-
- <!-- A pre-shared Direct Encryption key e.g. a pairwise client_secret from the input criterion -->
+
+ <!-- A resolver to resolve pre-shared Direct Encryption key e.g. a pairwise client_secret from the input criterion -->
<bean id="defaultOIDCRPContentEncryptionKeyCredentialResolver"
class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
<constructor-arg>
- <list>
+ <list>
<bean id="CriterionCredentialResolver"
class="net.shibboleth.oidc.security.credential.impl.CriterionCredentialResolver" />
</list>
@@ -211,9 +214,9 @@
class="net.shibboleth.oidc.security.impl.BasicSignatureValidationConfiguration"
p:signatureTrustEngine-ref="ExplicitKeySignedJWTTrustEngine">
</bean>
-
- <!-- A resolver for resolving trusted credentials to match against those used -->
+
+ <!-- A resolver for resolving trusted credentials to match against those used -->
<bean id="defaultSignedJWTTrustedCredentialResolver"
class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
<constructor-arg>
@@ -226,17 +229,17 @@
</list>
</constructor-arg>
</bean>
-
+
<!-- A resolver for resolving Credentials out of the JOSE header of JWTs -->
<bean id="defaultSignedJWTJOSEHeaderCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver"/>
+ class="net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver" />
<bean id="ExplicitKeySignedJWTTrustEngine"
class="net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine"
c:resolver-ref="defaultSignedJWTTrustedCredentialResolver"
c:JOSEObjectResolver-ref="defaultSignedJWTJOSEHeaderCredentialResolver" />
-
+
</beans>
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java
index 76e042a..5eeee7b 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java
@@ -17,11 +17,6 @@
package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.testng.Assert.assertEquals;
-import static org.testng.Assert.fail;
-
import java.net.InetAddress;
import java.net.URI;
import java.net.UnknownHostException;
@@ -425,8 +420,7 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
final var userInfoDecryptConfig = new BasicJWTDecryptionConfiguration();
userInfoDecryptConfig.setContentEncryptionKeyCredentialResolver(new CriterionCredentialResolver());
- securityConfig.setUserInfoJwtDecryptionConfiguration(userInfoDecryptConfig);
-
+ securityConfig.setUserInfoJwtDecryptionConfiguration(userInfoDecryptConfig);
return securityConfig;
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list