[java-idp-plugin-oidc-rp] branch main updated: Move provider metadata param resolver to commons
Phil Smart
philip.smart at jisc.ac.uk
Fri Aug 19 08:40:10 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=660f748fc6b5b0435361020e76819bbb68e99d78
The following commit(s) were added to refs/heads/main by this push:
new 660f748 Move provider metadata param resolver to commons
660f748 is described below
commit 660f748fc6b5b0435361020e76819bbb68e99d78
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Aug 19 09:40:04 2022 +0100
Move provider metadata param resolver to commons
---
...ignatureSigningConfigurationLookupFunction.java | 10 +-
...oviderMetadataEncryptionParametersResolver.java | 337 ------------------
.../oidc-relying-party-authn-beans.xml | 2 +-
.../idp/service/relying-party/postconfig.xml | 23 +-
...erMetadataEncryptionParametersResolverTest.java | 385 ---------------------
.../test/resources/conf/authn/rp-credentials.xml | 8 +-
6 files changed, 19 insertions(+), 746 deletions(-)
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/RequestObjectSignatureSigningConfigurationLookupFunction.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/RequestObjectSignatureSigningConfigurationLookupFunction.java
index a3e4951..1b3d687 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/RequestObjectSignatureSigningConfigurationLookupFunction.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/RequestObjectSignatureSigningConfigurationLookupFunction.java
@@ -25,15 +25,13 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.xmlsec.SignatureSigningConfiguration;
-import com.nimbusds.jwt.SignedJWT;
-
import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.config.SecurityConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
import net.shibboleth.idp.relyingparty.RelyingPartyConfigurationResolver;
import net.shibboleth.oidc.profile.config.OIDCSecurityConfiguration;
-import net.shibboleth.oidc.security.SignatureValidationConfiguration;
+import net.shibboleth.oidc.security.JWTSignatureSigningConfiguration;
/**
* A function that returns a {@link SignatureSigningConfiguration} list for request object signing by way
@@ -44,7 +42,7 @@ import net.shibboleth.oidc.security.SignatureValidationConfiguration;
* </p>
*/
public class RequestObjectSignatureSigningConfigurationLookupFunction
- extends AbstractRelyingPartyLookupFunction<List<SignatureSigningConfiguration>> {
+ extends AbstractRelyingPartyLookupFunction<List<JWTSignatureSigningConfiguration>> {
/** A resolver for default security configurations. */
@Nullable
@@ -62,9 +60,9 @@ public class RequestObjectSignatureSigningConfigurationLookupFunction
/** {@inheritDoc} */
@Override
@Nullable
- public List<SignatureSigningConfiguration> apply(@Nullable final ProfileRequestContext input) {
+ public List<JWTSignatureSigningConfiguration> apply(@Nullable final ProfileRequestContext input) {
- final List<SignatureSigningConfiguration> configs = new ArrayList<>();
+ final List<JWTSignatureSigningConfiguration> configs = new ArrayList<>();
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ProviderMetadataEncryptionParametersResolver.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ProviderMetadataEncryptionParametersResolver.java
deleted file mode 100644
index a0ba872..0000000
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ProviderMetadataEncryptionParametersResolver.java
+++ /dev/null
@@ -1,337 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
-
-import java.time.Duration;
-import java.time.Instant;
-import java.util.Collections;
-import java.util.List;
-import java.util.Objects;
-import java.util.function.Function;
-import java.util.function.Predicate;
-import java.util.stream.Collectors;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import com.nimbusds.jose.EncryptionMethod;
-import com.nimbusds.jose.JOSEException;
-import com.nimbusds.jose.JWEAlgorithm;
-import com.nimbusds.jose.jwk.ECKey;
-import com.nimbusds.jose.jwk.JWK;
-import com.nimbusds.jose.jwk.JWKSet;
-import com.nimbusds.jose.jwk.KeyType;
-import com.nimbusds.jose.jwk.KeyUse;
-import com.nimbusds.jose.jwk.RSAKey;
-import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
-
-import net.shibboleth.oidc.jwk.RemoteJwkSetCache;
-import net.shibboleth.oidc.security.JWTEncryptionConfiguration;
-import net.shibboleth.oidc.security.JWTEncryptionParameters;
-import net.shibboleth.oidc.security.credential.BasicJWKCredential;
-import net.shibboleth.oidc.security.criterion.JWKSetCriterion;
-import net.shibboleth.oidc.security.criterion.JWTEncryptionConfigurationCriterion;
-import net.shibboleth.oidc.security.criterion.ProviderMetadataCriterion;
-import net.shibboleth.oidc.security.impl.BasicJWTEncryptionParametersResolver;
-import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.logic.FunctionSupport;
-import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
-
-/**
- * An extension of {@link BasicJWTEncryptionParametersResolver} to support parameter resolution from an
- * OpenID Provider's metadata (remote keyset), in addition to those resolved from local configuration by the
- * base class.
- *
- * <p>The set of supported and configured key transport ('alg') and encryption methods ('enc') are derived
- * from the intersection of those supported by local configuration, and those supported by the downstream
- * OpenID Provider. The order of those algorithms in the local configuration are preserved, and affect which
- * credential is chosen. As algorithm 'alg' and 'enc' support is optional in provider metadata, failure to
- * locate them will result in the default behaviour of the parent class being applied (resolve from local
- * configuration). If they are present, but are not compatible with the set configured in the encryption
- * configuration, no parameters are returned (a failure). </p>
- *
- * <p>Generally, the following logic applies:</p>
- * <ul>
- * <li>Private KeyWrapping and direct encryption credentials are found in the local
- * {@link JWTEncryptionConfiguration}.</li>
- * <li>Public KeyEncryption or KeyAgreement credentials are found in the OpenID Provider's KeySet.
- * The Provider's metadata must be contained inside a ProviderMetadataCriterion, otherwise only local
- * credentials can be resolved.</li>
- * </ul>
- *
- *
- */
-public class ProviderMetadataEncryptionParametersResolver extends BasicJWTEncryptionParametersResolver {
-
- /** Logger. */
- private final Logger log = LoggerFactory.getLogger(ProviderMetadataEncryptionParametersResolver.class);
-
- /** A strategy to locate the encryption methods ('enc') appropriate for the JWT to be encrypted.*/
- @Nonnull private Function<OIDCProviderMetadata, List<EncryptionMethod>> providerEncryptionMethodsLookupStrategy;
-
- /** A strategy to locate the algorithms ('alg') appropriate for the JWT to be encrypted.*/
- @Nonnull private Function<OIDCProviderMetadata, List<JWEAlgorithm>> providerKeyTransportAlgorithmsLookupStrategy;
-
- /** The cache for remote JWK key sets. */
- @Nullable private RemoteJwkSetCache remoteJwkSetCache;
-
- /** The remote key refresh interval. Default value: 30 minutes. */
- @Positive
- private Duration keyFetchInterval = Duration.ofMinutes(30);
-
- /** Constructor.*/
- public ProviderMetadataEncryptionParametersResolver() {
- super();
- providerEncryptionMethodsLookupStrategy = FunctionSupport.constant(Collections.emptyList());
- providerKeyTransportAlgorithmsLookupStrategy = FunctionSupport.constant(Collections.emptyList());
- }
-
- /**
- * Set the strategy used to locate the algorothms ('alg') from the OpenID Provider metadata
- * appropriate for the JWT to be encrypted.
- *
- * @param strategy the strategy
- */
- public void setProviderKeyTransportAlgorithmsLookupStrategy(
- @Nonnull final Function<OIDCProviderMetadata, List<JWEAlgorithm>> strategy) {
-
- providerKeyTransportAlgorithmsLookupStrategy = Constraint.isNotNull(strategy,
- "ProviderAlgorithmsLookupStrategy can not be null");
- }
-
- /**
- * Set the strategy used to locate the encryption methods ('enc') from the OpenID Provider metadata
- * appropriate for the JWT to be encrypted.
- *
- * @param strategy the strategy
- */
- public void setProviderEncryptionMethodsLookupStrategy(
- @Nonnull final Function<OIDCProviderMetadata, List<EncryptionMethod>> strategy) {
-
- providerEncryptionMethodsLookupStrategy = Constraint.isNotNull(strategy,
- "ProviderEncryptionMethodsLookupStrategy can not be null");
- }
-
- /**
- * Set the cache for remote JWK key sets.
- *
- * @param jwkSetCache What to set.
- */
- public void setRemoteJwkSetCache(final RemoteJwkSetCache jwkSetCache) {
- remoteJwkSetCache = Constraint.isNotNull(jwkSetCache, "The remote JWK set cache cannot be null");
- }
-
- /**
- * Set the remote key refresh interval.
- *
- * @param interval What to set.
- */
- public void setKeyFetchInterval(@Positive final Duration interval) {
- Constraint.isFalse(interval == null || interval.isNegative(), "Remote key refresh must be greater than 0");
- keyFetchInterval = interval;
- }
-
- @Override
- protected void resolveAndPopulateCredentialsAndAlgorithms(@Nonnull final JWTEncryptionParameters params,
- @Nonnull final CriteriaSet criteria, @Nonnull final Predicate<String> includeExcludePredicate) {
-
- if (remoteJwkSetCache == null) {
- log.debug("OIDC Provider metadata encryption parameters resolver does not have a remote JWKSet cache set,"
- + "falling back to default local configuration");
- super.resolveAndPopulateCredentialsAndAlgorithms(params, criteria, includeExcludePredicate);
- return;
- }
-
- if (!criteria.contains(JWTEncryptionConfigurationCriterion.class)) {
- log.debug("No encryption configuration criterion, encryption parameters can not be resolved");
- return;
- }
-
- if (!criteria.contains(ProviderMetadataCriterion.class)) {
- log.debug("No provider metadata criterion, falling back to local configuration");
- super.resolveAndPopulateCredentialsAndAlgorithms(params, criteria, includeExcludePredicate);
- return;
- }
- final OIDCProviderMetadata metadata = criteria.get(ProviderMetadataCriterion.class).getMetadata();
-
- final List<JWTEncryptionConfiguration> encryptionConfigurations =
- criteria.get(JWTEncryptionConfigurationCriterion.class).getConfigurations();
- if (encryptionConfigurations.isEmpty()) {
- log.debug("No encryption configuration, encryption parameters can not be resolved");
- return;
- }
-
- // We populate the parameters for the algorithms the provider has registered in metadata
- final List<JWEAlgorithm> keyTransportAlgorithms =
- providerKeyTransportAlgorithmsLookupStrategy.apply(metadata);
- log.trace("Resolved effective key transport algorithms from provider metadata: {}", keyTransportAlgorithms);
- if (keyTransportAlgorithms.isEmpty()) {
- log.debug("No algorithm ('alg') information in provider metadata, "
- + "falling back to default local configuration");
- super.resolveAndPopulateCredentialsAndAlgorithms(params, criteria, includeExcludePredicate);
- return;
- }
-
- final List<EncryptionMethod> dataEncryptionMethods =
- providerEncryptionMethodsLookupStrategy.apply(metadata);
- log.trace("Resolved effective data encryption algorithms from provider metadata: {}", dataEncryptionMethods);
-
- final List<String> keyTransportAlgorithmSupported =
- getEffectiveKeyTransportAlgorithms(criteria, includeExcludePredicate);
- log.trace("Resolved supported key transport algorithms from config: {}",
- keyTransportAlgorithmSupported);
-
- final List<String> dataEncryptionAlgorithmsSupported =
- getEffectiveDataEncryptionAlgorithms(criteria, includeExcludePredicate);
- log.trace("Resolved supported data encryption algorithms from config: {}", dataEncryptionAlgorithmsSupported);
-
-
- final List<String> supportedAndConfiguredKeyTransportAlgorithms =
- findAlgorithmIntersection(keyTransportAlgorithms.stream().map(JWEAlgorithm::getName)
- .collect(Collectors.toList()),keyTransportAlgorithmSupported);
-
- final List<String> supportedAndConfiguredDataEncryptionAlgorithms =
- findAlgorithmIntersection(dataEncryptionMethods.stream().map(EncryptionMethod::getName)
- .collect(Collectors.toList()),dataEncryptionAlgorithmsSupported);
-
- log.debug("Supported and configured key transport algorithms: {}",
- supportedAndConfiguredKeyTransportAlgorithms);
- log.debug("Supported and configured data encryption algorithms: {}",
- supportedAndConfiguredDataEncryptionAlgorithms);
-
- if (supportedAndConfiguredKeyTransportAlgorithms.isEmpty()) {
- log.warn("No supported key transport algorithm. Provider metadata and configuration are not compatible");
- return;
- }
- if (supportedAndConfiguredDataEncryptionAlgorithms.isEmpty()) {
- log.warn("No supported data encryption method. Provider metadata and configuration are not compatible");
- return;
- }
-
- // Add JWKSet criterion so the callback methods can pull out the OP's JWK set.
- criteria.add(new JWKSetCriterion(getProviderKeys(metadata)));
-
- // Now we have resolved the set of supported 'alg' and 'enc' algorithms, delegate back to the base
- // class to check locally configured credentials, and call back to this class to resolve from
- // the providers key set.
- super.resolveCredentialForSupportedAlgorithm(criteria,
- convertStringAlgorithmURIsToJwkAlgorithms(supportedAndConfiguredKeyTransportAlgorithms),
- convertStringEncryptionMethodURIsToEncryptionMethods(supportedAndConfiguredDataEncryptionAlgorithms),
- getEffectiveKeyTransportCredentials(criteria),
- getEffectiveDataEncryptionCredentials(criteria),
- params);
-
- if (params.getKeyTransportEncryptionCredential() == null && params.getDataEncryptionCredential() == null) {
- log.debug("Unable to resolve either key transport or data encryption credential");
- }
- }
-
- /**
- * {@inheritDoc}
- * <p>Resolves key transport credentials compatible with the given algorithm from those defined in the
- * OP's JWKSet (stored in the criteria).</p>
- */
- @Override
- protected void resolveKeyTransportCredentialForSupportedAlgorithmFromAdditionalSource(
- @Nonnull final JWEAlgorithm algorithm, @Nonnull final EncryptionMethod encryptionMethod,
- @Nonnull final CriteriaSet criteria, @Nonnull final JWTEncryptionParameters params) {
-
- final JWKSetCriterion jwkSetCriterion = criteria.get(JWKSetCriterion.class);
- if (jwkSetCriterion == null) {
- log.debug("Unable to find JWKSet criterion, can not resolver provider keys");
- return;
- }
- final JWKSet providerKeySet = jwkSetCriterion.getJWKSet();
- if (providerKeySet == null) {
- log.debug("Unable to find keys in JWKSet criterion, can not resolver provider keys");
- return;
- }
-
- // All keys in provider metadata should be key transport, not direct data/content encryption, as that
- // is a public document.
- final JWK key =
- providerKeySet.getKeys().stream()
- .filter(Objects::nonNull)
- .filter(k -> KeyUse.ENCRYPTION == k.getKeyUse())
- .filter(k -> k.getAlgorithm().equals(algorithm))
- .findFirst().orElse(null);
-
- if (key != null) {
- final BasicJWKCredential jwkCredential = new BasicJWKCredential();
- jwkCredential.setAlgorithm(algorithm);
- jwkCredential.setKid(key.getKeyID());
- try {
- if (key.getKeyType().equals(KeyType.RSA)) {
- jwkCredential.setPublicKey(((RSAKey) key).toPublicKey());
- } else if (key.getKeyType().equals(KeyType.EC)){
- jwkCredential.setPublicKey(((ECKey) key).toPublicKey());
- }
- } catch (final JOSEException e) {
- log.warn("Unable to parse keyset", e);
- return;
- }
- if (checkKeyAlgorithmAndLength(jwkCredential, algorithm.getName())) {
- log.debug("Selected key '{}' for alg {} and enc {}", key.getKeyID(),
- algorithm.getName(), encryptionMethod.getName());
- params.setKeyTransportEncryptionCredential(jwkCredential);
- params.setKeyTransportEncryptionAlgorithm(algorithm.getName());
- params.setDataEncryptionAlgorithm(encryptionMethod.getName());
- }
- }
-
- }
-
- /**
- * Fetch the OpenID Provider's remote JWKSet.
- *
- * @param metadata the OpenID Provider's metadata
- *
- * @return the JSON Web Keys set. Or an empty key set if the fetch failed.
- */
- @Nonnull private JWKSet getProviderKeys(@Nonnull final OIDCProviderMetadata metadata) {
- final JWKSet keys = remoteJwkSetCache.fetch(metadata.getJWKSetURI(),
- Instant.now().plus(keyFetchInterval));
- if (keys == null) {
- return new JWKSet();
- } else {
- return keys;
- }
- }
-
- /**
- * Return a new list of algorithms that represents the set intersection of the two input algorithm lists.
- * The original order of algorithms from the {@code configAlgorithms} list is preserved.
- *
- * @param providerAlgorithms the set of algorithms specified by the OpenID Provider
- * @param configAlgorithms the set of algorithms specified by the IdP's configuration
- *
- * @return the intersection of both lists
- */
- @Nonnull private List<String> findAlgorithmIntersection(@Nonnull final List<String> providerAlgorithms,
- @Nonnull final List<String> configAlgorithms){
- return configAlgorithms.stream().filter(providerAlgorithms::contains).collect(Collectors.toList());
-
- }
-
-
-
-}
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
index b3c7b83..f362072 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
@@ -198,7 +198,7 @@
p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
<bean id="shibboleth.authn.oidc.rp.EncryptionParametersResolver"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.ProviderMetadataEncryptionParametersResolver"
+ class="net.shibboleth.oidc.security.impl.ProviderMetadataEncryptionParametersResolver"
p:remoteJwkSetCache-ref="shibboleth.authn.oidc.rp.RemoteJwkSetCache">
<property name="providerEncryptionMethodsLookupStrategy">
<bean class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.ProviderRequestObjectEncryptionMethodsLookupFunction"/>
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index fe7479f..3d8a1fe 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -59,6 +59,12 @@
</list>
</entry>
</util:map>
+
+ <!-- The default credential is based on the client_secret, and will be the only used credential in most cases -->
+ <bean id="shibboleth.authn.oidc.rp.DefaultCredential" parent="shibboleth.authn.oidc.rp.ExpiringJWKCredential"
+ p:secret="%{idp.authn.oidc.rp.client.clientSecret:#{null}}"
+ p:keyNames="%{idp.authn.oidc.rp.client.clientSecretKeyName:defaultPropertiesClientSecret}"
+ p:alg="dir" />
<!-- Security Configuration Defaults. These settings establish the default security configurations for signatures and
@@ -71,7 +77,7 @@
p:excludedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.ExcludedSignatureAlgorithms')}" />
<bean id="shibboleth.authn.oidc.rp.BasicSignatureSigningConfiguration" abstract="true"
- class="org.opensaml.xmlsec.impl.BasicSignatureSigningConfiguration"
+ class="net.shibboleth.oidc.security.impl.BasicJWTSignatureSigningConfiguration"
p:includedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.IncludedSignatureAlgorithms')}"
p:excludedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.ExcludedSignatureAlgorithms')}" />
@@ -96,8 +102,6 @@
<ref
bean="#{'%{idp.authn.oidc.rp.idtoken.valid.config:shibboleth.authn.oidc.rp.DefaultJWTSignatureValidationConfiguration}'.trim()}" />
</property>
- <!-- User info config is actually the same by default as id_token, not sure we need seperation, although could be
- overriden -->
<property name="userInfoJwtDecryptionConfiguration">
<ref
bean="#{'%{idp.authn.oidc.rp.userinfotoken.decrypt.config:shibboleth.authn.oidc.rp.DefaultJWTDecryptionConfiguration}'.trim()}" />
@@ -110,8 +114,7 @@
<ref
bean="#{'%{idp.authn.oidc.rp.requestobject.signing.config:shibboleth.authn.oidc.rp.DefaultRequestObjectSigningConfiguration}'.trim()}" />
</property>
- <!-- For now, Request Object encryption configuration only -->
- <property name="requestObjectEncryptionConfig">
+ <property name="requestObjectEncryptionConfiguration">
<ref
bean="#{'%{idp.authn.oidc.rp.requestobject.encryption.config:shibboleth.authn.oidc.rp.DefaultRequestObjectEncryptionConfiguration}'.trim()}" />
</property>
@@ -167,7 +170,7 @@
<!-- Configuration for credentials and supported algorithms for request object request signing. Any shared secret credential
from the RP's configuration will be included in the set of usable credentials -->
<bean id="shibboleth.authn.oidc.rp.DefaultRequestObjectSigningConfiguration"
- parent="shibboleth.BasicSignatureSigningConfiguration"
+ parent="shibboleth.authn.oidc.rp.BasicSignatureSigningConfiguration"
p:signingCredentials-ref="shibboleth.authn.oidc.rp.SigningCredentials">
<property name="signatureAlgorithms">
<list>
@@ -199,12 +202,6 @@
class="net.shibboleth.idp.plugin.authn.oidc.rp.config.CredentialsListFactory"
c:_0="#{getObject('shibboleth.authn.oidc.rp.DefaultRequestObjectDataEncryptionCredentials')}" />
-
- <bean id="shibboleth.authn.oidc.rp.DefaultCredential" parent="shibboleth.authn.oidc.rp.ExpiringJWKCredential"
- p:secret="%{idp.authn.oidc.rp.client.clientSecret:#{null}}"
- p:keyNames="%{idp.authn.oidc.rp.client.clientSecretKeyName:defaultPropertiesClientSecret}"
- p:alg="dir" />
-
<bean id="shibboleth.authn.oidc.rp.DefaultJWTDecryptionConfiguration"
parent="shibboleth.authn.oidc.rp.BasicDecryptionConfiguration"
p:KEKCredentialResolver-ref="defaultOIDCRPKeyEncryptionCredentialResolver"
@@ -246,7 +243,7 @@
</bean>
- <!-- A resolver for resolving trusted credentials to match against those used -->
+ <!-- A resolver for resolving trusted credentials to match against those resolved from the JWT -->
<bean id="defaultSignedJWTTrustedCredentialResolver"
class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
<constructor-arg>
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ProviderMetadataEncryptionParametersResolverTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ProviderMetadataEncryptionParametersResolverTest.java
deleted file mode 100644
index 514f8a8..0000000
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ProviderMetadataEncryptionParametersResolverTest.java
+++ /dev/null
@@ -1,385 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
-
-import static org.junit.Assert.assertNull;
-import static org.testng.Assert.assertEquals;
-import static org.testng.Assert.assertFalse;
-import static org.testng.Assert.assertNotNull;
-import static org.testng.Assert.assertTrue;
-import static org.testng.Assert.fail;
-
-import java.io.IOException;
-import java.util.List;
-
-import org.apache.http.HttpResponse;
-import org.apache.http.client.ClientProtocolException;
-import org.apache.http.client.HttpClient;
-import org.apache.http.client.methods.HttpUriRequest;
-import org.apache.http.entity.StringEntity;
-import org.apache.http.protocol.HttpContext;
-import org.mockito.Mockito;
-import org.opensaml.core.config.InitializationException;
-import org.opensaml.storage.StorageService;
-import org.opensaml.storage.impl.MemoryStorageService;
-import org.opensaml.xmlsec.config.GlobalAlgorithmRegistryInitializer;
-import org.springframework.core.io.ClassPathResource;
-import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Test;
-
-import com.nimbusds.jose.JWEAlgorithm;
-import com.nimbusds.jose.jwk.KeyUse;
-import com.nimbusds.jose.jwk.RSAKey;
-import com.nimbusds.jose.jwk.gen.RSAKeyGenerator;
-import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
-
-import net.shibboleth.oidc.jwa.support.EncryptionConstants;
-import net.shibboleth.oidc.jwa.support.KeyManagementConstants;
-import net.shibboleth.oidc.jwk.RemoteJwkSetCache;
-import net.shibboleth.oidc.security.JWTEncryptionParameters;
-import net.shibboleth.oidc.security.credential.JWKCredential;
-import net.shibboleth.oidc.security.criterion.JWTEncryptionConfigurationCriterion;
-import net.shibboleth.oidc.security.criterion.ProviderMetadataCriterion;
-import net.shibboleth.oidc.security.criterion.StaticCredentialCriterion;
-import net.shibboleth.oidc.security.impl.BasicJWTEncryptionConfiguration;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
-
-/** Tests for the {@link ProviderMetadataEncryptionParametersResolver}.*/
-public class ProviderMetadataEncryptionParametersResolverTest {
-
- /**
- * Example of good provider metadata that supports request_object_encryption.
- */
- private static final ClassPathResource GOOD_PROVIDER_CONFIGURATION_INFO =
- new ClassPathResource("/metadata/test-resolver-provider-encryption.json");
-
- /** A remote JWKSet.*/
- private static final ClassPathResource REMOTE_JWKSET =
- new ClassPathResource("/conf/credentials/test-provider-resolver-remote-jwkset-response.jwk");
-
- /** The client_secret.*/
- private static final String CLIENT_SECRET = "Xp2s5v8y/B?E(H+MbQeThWmYq3t6w9z$";
-
- /** The mock symmetric key e.g. for keywrap.*/
- private static final String SYMMETRIC_KEY = "/A?D(G+KbPdSgVkYp3s6v9y$B&E)H at Mc";
-
- /** A second mock symmetric key e.g. for keywrap.*/
- private static final String SYMMETRIC_KEY_TWO = "/ArB(G+KbPdSgVkYp3s6v9y$B&E)H at Mc";
-
- /** The resolver to test.*/
- private ProviderMetadataEncryptionParametersResolver resolver;
-
- /** The basic config.*/
- private BasicJWTEncryptionConfiguration config;
-
-
- @BeforeMethod
- public void setup() throws ComponentInitializationException, ClientProtocolException, IOException {
- //Create an algorithm registry here, as opensaml init will not take place for these tests
- try {
- final GlobalAlgorithmRegistryInitializer gar = new GlobalAlgorithmRegistryInitializer();
- gar.init();
- } catch (final InitializationException e) {
- fail();
- }
-
- resolver = new ProviderMetadataEncryptionParametersResolver();
- resolver.setProviderEncryptionMethodsLookupStrategy(OIDCProviderMetadata::getRequestObjectJWEEncs);
- resolver.setProviderKeyTransportAlgorithmsLookupStrategy(OIDCProviderMetadata::getRequestObjectJWEAlgs);
- final RemoteJwkSetCache cache = new RemoteJwkSetCache();
- cache.setStorage(buildStorageService());
- cache.setHttpClient(createMockHttpClient(TestJsonHelper.readJsonFromFile(REMOTE_JWKSET)));
- resolver.setRemoteJwkSetCache(cache);
- }
-
- protected HttpClient createMockHttpClient(final String output) throws ClientProtocolException, IOException {
- final HttpClient httpClient = Mockito.mock(HttpClient.class);
- final HttpResponse httpResponse = Mockito.mock(HttpResponse.class);
- Mockito.when(httpResponse.getEntity()).thenReturn(new StringEntity(output));
- Mockito.when(httpClient.execute((HttpUriRequest) Mockito.any(),
- (HttpContext) Mockito.any())).thenReturn(httpResponse);
- return httpClient;
- }
-
- private StorageService buildStorageService() throws ComponentInitializationException {
- final MemoryStorageService storageService = new MemoryStorageService();
- storageService.setId("mockId");
- storageService.initialize();
- return storageService;
- }
-
- private CriteriaSet buildBasicCriteriaSet() throws Exception {
-
- config = new BasicJWTEncryptionConfiguration();
- config.setKeyTransportEncryptionAlgorithms(
- List.of(KeyManagementConstants.ALGO_ID_ALG_AES_128_KW, KeyManagementConstants.ALGO_ID_ALG_RSA_OAEP_256,
- KeyManagementConstants.ALGO_ID_ALG_ECDH_ES_AES_192_KW, KeyManagementConstants.ALGO_ID_ALG_RSA_OAEP));
- config.setDataEncryptionAlgorithms(
- List.of(EncryptionConstants.ALGO_ID_ENC_ALG_A128CBC_HS256,EncryptionConstants.ALGO_ID_ENC_ALG_A128GCM,
- EncryptionConstants.ALGO_ID_ENC_ALG_A256CBC_HS512));
- final CriteriaSet criteria = new CriteriaSet(new JWTEncryptionConfigurationCriterion(List.of(config)));
- criteria.add(new ProviderMetadataCriterion(
- OIDCProviderMetadata.parse(TestJsonHelper.readJsonFromFile(GOOD_PROVIDER_CONFIGURATION_INFO))));
- criteria.add(
- new StaticCredentialCriterion(TestCredentialHelper.createClientSecretCredential(CLIENT_SECRET)));
- return criteria;
- }
-
- @Test
- public void testSuccessfulResolution() throws Exception {
- final Iterable<JWTEncryptionParameters> params = resolver.resolve(buildBasicCriteriaSet());
- assertNotNull(params);
- assertTrue(params.iterator().hasNext());
- final JWTEncryptionParameters param = params.iterator().next();
- assertNotNull(param.getDataEncryptionAlgorithm());
- assertNotNull(param.getKeyTransportEncryptionAlgorithm());
- assertNotNull(param.getKeyTransportEncryptionCredential());
- assertNotNull(param.getKeyTransportEncryptionCredential().getPublicKey());
- }
-
- /* Algorithms are know because they are limited by config.*/
- @Test
- public void testSuccessfulResolution_ForKeyEncryption() throws Exception {
- final CriteriaSet criteria = buildBasicCriteriaSet();
- config.setKeyTransportEncryptionAlgorithms(List.of(KeyManagementConstants.ALGO_ID_ALG_RSA_OAEP));
- config.setDataEncryptionAlgorithms(List.of(EncryptionConstants.ALGO_ID_ENC_ALG_A256CBC_HS512));
-
- final Iterable<JWTEncryptionParameters> params = resolver.resolve(criteria);
- assertNotNull(params);
- assertTrue(params.iterator().hasNext());
- final JWTEncryptionParameters param = params.iterator().next();
- assertNotNull(param.getDataEncryptionAlgorithm());
- assertNotNull(param.getKeyTransportEncryptionAlgorithm());
- assertEquals(param.getDataEncryptionAlgorithm(),EncryptionConstants.ALGO_ID_ENC_ALG_A256CBC_HS512);
- assertEquals(param.getKeyTransportEncryptionAlgorithm(),KeyManagementConstants.ALGO_ID_ALG_RSA_OAEP);
- assertNotNull(param.getKeyTransportEncryptionCredential());
- assertNotNull(param.getKeyTransportEncryptionCredential().getPublicKey());
- }
-
- /* Should chose key encryption creds as they are the only ones configured, and are first
- * in the algorithm list*/
- @Test
- public void testSuccessfulResolution_ForKeyEncryption_WhenKeyWrapPossible() throws Exception {
- final CriteriaSet criteria = buildBasicCriteriaSet();
- config.setKeyTransportEncryptionAlgorithms(List.of(KeyManagementConstants.ALGO_ID_ALG_RSA_OAEP,
- KeyManagementConstants.ALGO_ID_ALG_AES_128_KW));
- config.setDataEncryptionAlgorithms(List.of(EncryptionConstants.ALGO_ID_ENC_ALG_A256CBC_HS512));
-
- final Iterable<JWTEncryptionParameters> params = resolver.resolve(criteria);
- assertNotNull(params);
- assertTrue(params.iterator().hasNext());
- final JWTEncryptionParameters param = params.iterator().next();
- assertNotNull(param.getDataEncryptionAlgorithm());
- assertNotNull(param.getKeyTransportEncryptionAlgorithm());
- assertEquals(param.getDataEncryptionAlgorithm(),EncryptionConstants.ALGO_ID_ENC_ALG_A256CBC_HS512);
- assertEquals(param.getKeyTransportEncryptionAlgorithm(),KeyManagementConstants.ALGO_ID_ALG_RSA_OAEP);
- assertNotNull(param.getKeyTransportEncryptionCredential());
- assertNotNull(param.getKeyTransportEncryptionCredential().getPublicKey());
- }
-
- /* Should chose key wrap creds first, as that algorithm is first in the list.*/
- @Test
- public void testSuccessfulResolution_ForKeyWrap_WhenKeyEncryptionPossible() throws Exception {
- final CriteriaSet criteria = buildBasicCriteriaSet();
- config.setKeyTransportEncryptionAlgorithms(List.of(KeyManagementConstants.ALGO_ID_ALG_AES_256_KW,
- KeyManagementConstants.ALGO_ID_ALG_RSA_OAEP));
- config.setDataEncryptionAlgorithms(List.of(EncryptionConstants.ALGO_ID_ENC_ALG_A256CBC_HS512));
- config.setKeyTransportEncryptionCredentials(
- List.of(TestCredentialHelper.createClientSecretCredential("mockKey",
- SYMMETRIC_KEY, JWEAlgorithm.A256KW)));
-
- final Iterable<JWTEncryptionParameters> params = resolver.resolve(criteria);
- assertNotNull(params);
- assertTrue(params.iterator().hasNext());
- final JWTEncryptionParameters param = params.iterator().next();
- assertNotNull(param.getDataEncryptionAlgorithm());
- assertNotNull(param.getKeyTransportEncryptionAlgorithm());
- assertEquals(param.getDataEncryptionAlgorithm(),EncryptionConstants.ALGO_ID_ENC_ALG_A256CBC_HS512);
- assertEquals(param.getKeyTransportEncryptionAlgorithm(),KeyManagementConstants.ALGO_ID_ALG_AES_256_KW);
- assertNotNull(param.getKeyTransportEncryptionCredential());
- assertNotNull(param.getKeyTransportEncryptionCredential().getSecretKey());
- }
-
- @Test
- public void testSuccessfulResolution_ForKeyWrap() throws Exception {
- final CriteriaSet criteria = buildBasicCriteriaSet();
- config.setKeyTransportEncryptionAlgorithms(List.of(KeyManagementConstants.ALGO_ID_ALG_AES_256_KW));
- config.setDataEncryptionAlgorithms(List.of(EncryptionConstants.ALGO_ID_ENC_ALG_A128GCM));
- config.setKeyTransportEncryptionCredentials(
- List.of(TestCredentialHelper.createClientSecretCredential("mockKey", SYMMETRIC_KEY,
- JWEAlgorithm.A256KW)));
-
- final Iterable<JWTEncryptionParameters> params = resolver.resolve(criteria);
- assertNotNull(params);
- assertTrue(params.iterator().hasNext());
- final JWTEncryptionParameters param = params.iterator().next();
- assertNotNull(param.getDataEncryptionAlgorithm());
- assertNotNull(param.getKeyTransportEncryptionAlgorithm());
- assertEquals(param.getDataEncryptionAlgorithm(),EncryptionConstants.ALGO_ID_ENC_ALG_A128GCM);
- assertEquals(param.getKeyTransportEncryptionAlgorithm(),KeyManagementConstants.ALGO_ID_ALG_AES_256_KW);
- assertNotNull(param.getKeyTransportEncryptionCredential());
- assertNotNull(param.getKeyTransportEncryptionCredential().getSecretKey());
- }
-
- /* Runtime does not yet support 'dir' key transport, so disabled for now.*/
- @Test(enabled = false)
- public void testSuccessfulResolution_ForDirectEncryption() throws Exception {
- final CriteriaSet criteria = buildBasicCriteriaSet();
- config.setKeyTransportEncryptionAlgorithms(List.of(KeyManagementConstants.ALGO_ID_ALG_DIR));
- config.setDataEncryptionAlgorithms(List.of(EncryptionConstants.ALGO_ID_ENC_ALG_A256GCM));
- config.setDataEncryptionCredentials(
- List.of(TestCredentialHelper.createClientSecretCredential("mockKey", SYMMETRIC_KEY,
- JWEAlgorithm.DIR)));
-
- final Iterable<JWTEncryptionParameters> params = resolver.resolve(criteria);
- assertNotNull(params);
- assertTrue(params.iterator().hasNext());
- final JWTEncryptionParameters param = params.iterator().next();
- assertNotNull(param.getDataEncryptionAlgorithm());
- assertNotNull(param.getKeyTransportEncryptionAlgorithm());
- assertEquals(param.getDataEncryptionAlgorithm(),EncryptionConstants.ALGO_ID_ENC_ALG_A256GCM);
- assertEquals(param.getKeyTransportEncryptionAlgorithm(),KeyManagementConstants.ALGO_ID_ALG_DIR);
- assertNull(param.getKeyTransportEncryptionCredential());
- assertNotNull(param.getDataEncryptionCredential());
- assertNotNull(param.getDataEncryptionCredential().getSecretKey());
- assertTrue(param.getDataEncryptionCredential().getKeyNames().contains("mockKey"));
- }
-
- /*
- * The local RSA key should be derived from the local config even if provider metadata is excluded from
- * the criteria set.
- */
- @Test
- public void testSuccessfulResolution_NoProviderMetadata_FallBackToLocalBehaviour() throws Exception {
- // Do not add ProviderMetadataCriterion
- buildBasicCriteriaSet();
- final CriteriaSet criteria = new CriteriaSet(new JWTEncryptionConfigurationCriterion(List.of(config)));
-
- config.setKeyTransportEncryptionAlgorithms(List.of(KeyManagementConstants.ALGO_ID_ALG_RSA_OAEP_256));
- config.setDataEncryptionAlgorithms(List.of(EncryptionConstants.ALGO_ID_ENC_ALG_A128GCM));
-
- final RSAKey key = new RSAKeyGenerator(2048)
- .algorithm(JWEAlgorithm.RSA_OAEP_256)
- .keyUse(KeyUse.ENCRYPTION)
- .keyID("mock-key")
- .generate();
-
- config.setKeyTransportEncryptionCredentials(
- List.of(TestCredentialHelper.createKeyEncryptionCredential(key)));
-
- final Iterable<JWTEncryptionParameters> params = resolver.resolve(criteria);
- assertNotNull(params);
- assertTrue(params.iterator().hasNext());
- final JWTEncryptionParameters param = params.iterator().next();
- assertNotNull(param.getDataEncryptionAlgorithm());
- assertNotNull(param.getKeyTransportEncryptionAlgorithm());
- assertEquals(param.getDataEncryptionAlgorithm(),EncryptionConstants.ALGO_ID_ENC_ALG_A128GCM);
- assertEquals(param.getKeyTransportEncryptionAlgorithm(),KeyManagementConstants.ALGO_ID_ALG_RSA_OAEP_256);
- assertNotNull(param.getKeyTransportEncryptionCredential());
- assertTrue(param.getKeyTransportEncryptionCredential().getKeyNames().contains("mock-key"));
- assertNotNull(param.getKeyTransportEncryptionCredential().getPublicKey());
- }
-
- /* The first mockKey in the list should be resolved.*/
- @Test
- public void testSuccessfulResolution_ForKeyWrap_MoreThanOneKeyWrapCred() throws Exception {
- final CriteriaSet criteria = buildBasicCriteriaSet();
- config.setKeyTransportEncryptionAlgorithms(List.of(KeyManagementConstants.ALGO_ID_ALG_AES_256_KW));
- config.setDataEncryptionAlgorithms(List.of(EncryptionConstants.ALGO_ID_ENC_ALG_A128GCM));
- config.setKeyTransportEncryptionCredentials(
- List.of(TestCredentialHelper.createClientSecretCredential("mockKey", SYMMETRIC_KEY,
- JWEAlgorithm.A256KW),
- TestCredentialHelper.createClientSecretCredential("mockKeyTwo", SYMMETRIC_KEY_TWO,
- JWEAlgorithm.A256KW)));
-
- final Iterable<JWTEncryptionParameters> params = resolver.resolve(criteria);
- assertNotNull(params);
- assertTrue(params.iterator().hasNext());
- final JWTEncryptionParameters param = params.iterator().next();
- assertNotNull(param.getDataEncryptionAlgorithm());
- assertNotNull(param.getKeyTransportEncryptionAlgorithm());
- assertEquals(param.getDataEncryptionAlgorithm(),EncryptionConstants.ALGO_ID_ENC_ALG_A128GCM);
- assertEquals(param.getKeyTransportEncryptionAlgorithm(),KeyManagementConstants.ALGO_ID_ALG_AES_256_KW);
- // TODO this is not guaranteed, so should we be checking it?
- assertEquals(((JWKCredential)param.getKeyTransportEncryptionCredential()).getKid(),"mockKey");
- assertNotNull(param.getKeyTransportEncryptionCredential());
- assertNotNull(param.getKeyTransportEncryptionCredential().getSecretKey());
- }
-
- /* Do not provide a symmetric key in the params.*/
- @Test
- public void testUnSuccessfulResolution_ForKeyWrap() throws Exception {
- final CriteriaSet criteria = buildBasicCriteriaSet();
- config.setKeyTransportEncryptionAlgorithms(List.of(KeyManagementConstants.ALGO_ID_ALG_AES_256_KW));
- config.setDataEncryptionAlgorithms(List.of(EncryptionConstants.ALGO_ID_ENC_ALG_A128GCM));
-
- final Iterable<JWTEncryptionParameters> params = resolver.resolve(criteria);
- assertNotNull(params);
- assertFalse(params.iterator().hasNext());
- }
-
- @Test
- public void testSuccessfulResolution_ForKeyAgreement() throws Exception {
- final CriteriaSet criteria = buildBasicCriteriaSet();
- config.setKeyTransportEncryptionAlgorithms(List.of(KeyManagementConstants.ALGO_ID_ALG_ECDH_ES));
- config.setDataEncryptionAlgorithms(List.of(EncryptionConstants.ALGO_ID_ENC_ALG_A128GCM));
-
- final Iterable<JWTEncryptionParameters> params = resolver.resolve(criteria);
- assertNotNull(params);
- assertTrue(params.iterator().hasNext());
- final JWTEncryptionParameters param = params.iterator().next();
- assertNotNull(param.getDataEncryptionAlgorithm());
- assertNotNull(param.getKeyTransportEncryptionAlgorithm());
- assertEquals(param.getDataEncryptionAlgorithm(),EncryptionConstants.ALGO_ID_ENC_ALG_A128GCM);
- assertEquals(param.getKeyTransportEncryptionAlgorithm(),KeyManagementConstants.ALGO_ID_ALG_ECDH_ES);
- assertNotNull(param.getKeyTransportEncryptionCredential());
- assertNotNull(param.getKeyTransportEncryptionCredential().getPublicKey());
- }
-
- @Test
- public void testUnSuccessfulResolution_NoSupportedKeyTransportAlgorithm() throws Exception {
- final CriteriaSet criteria = buildBasicCriteriaSet();
- config.setKeyTransportEncryptionAlgorithms(List.of("NOT-SUPPORTED"));
-
- final Iterable<JWTEncryptionParameters> params = resolver.resolve(criteria);
- assertNotNull(params);
- assertFalse(params.iterator().hasNext());
- }
-
- @Test
- public void testUnSuccessfulResolution_OnlyConfigCriterion() throws Exception {
- buildBasicCriteriaSet();
- final CriteriaSet criteria = new CriteriaSet(new JWTEncryptionConfigurationCriterion(List.of(config)));
-
- final Iterable<JWTEncryptionParameters> params = resolver.resolve(criteria);
- assertNotNull(params);
- assertFalse(params.iterator().hasNext());
- }
-
- @Test
- public void testUnSuccessfulResolution_NoSupportedDataEncryptionMethod() throws Exception {
- final CriteriaSet criteria = buildBasicCriteriaSet();
- config.setDataEncryptionAlgorithms(List.of("NOT-SUPPORTED"));
-
- final Iterable<JWTEncryptionParameters> params = resolver.resolve(criteria);
- assertNotNull(params);
- assertFalse(params.iterator().hasNext());
- }
-
-}
diff --git a/idp-oidc-rp-impl/src/test/resources/conf/authn/rp-credentials.xml b/idp-oidc-rp-impl/src/test/resources/conf/authn/rp-credentials.xml
index 1d1ab5d..8c8a19d 100644
--- a/idp-oidc-rp-impl/src/test/resources/conf/authn/rp-credentials.xml
+++ b/idp-oidc-rp-impl/src/test/resources/conf/authn/rp-credentials.xml
@@ -17,13 +17,13 @@
<util:list id="shibboleth.authn.oidc.rp.DefaultRequestObjectKeyTransportEncryptionCredentials">
<bean parent="shibboleth.authn.oidc.rp.JWKCredential" p:failIfResourceIsNull="false"
- p:resource="%{idp.authn.oidc.rp.client.requestobject.enc.key:#{null}}" />
+ p:resource="%{idp.authn.oidc.rp.client.requestobject.enc.symmetric.kw.key:#{null}}" />
</util:list>
- <!-- <util:list id="shibboleth.authn.oidc.rp.DefaultRequestObjectDataEncryptionCredentials">
+ <util:list id="shibboleth.authn.oidc.rp.DefaultRequestObjectDataEncryptionCredentials">
<bean parent="shibboleth.authn.oidc.rp.JWKCredential" p:failIfResourceIsNull="false"
- p:resource="%{idp.authn.oidc.rp.client.requestobject.enc.key:#{null}}" />
- </util:list> -->
+ p:resource="%{idp.authn.oidc.rp.client.requestobject.enc.symmetric.cek.key:#{null}}" />
+ </util:list>
<!-- Default signing credentials -->
<util:list id="shibboleth.authn.oidc.rp.DefaultSigningCredentials">
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list