[java-idp-plugin-oidc-rp] branch main updated: Cleanup of rp service config
Phil Smart
philip.smart at jisc.ac.uk
Wed Aug 24 15:05:58 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=442568529b8f4230b79ac40f287b0d00249d2516
The following commit(s) were added to refs/heads/main by this push:
new 4425685 Cleanup of rp service config
4425685 is described below
commit 442568529b8f4230b79ac40f287b0d00249d2516
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Aug 24 16:05:52 2022 +0100
Cleanup of rp service config
---
.../idp/service/relying-party/postconfig.xml | 58 ++++++++--------------
.../authn/oidc/rp/conf/authn/oidc-rp-config.xml | 32 ++++++++----
2 files changed, 41 insertions(+), 49 deletions(-)
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index 3d8a1fe..83b52d8 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -11,20 +11,15 @@
<!-- OIDC RP Profile Configurations. -->
+ <!-- FIXME This will NEED a new ID and possibly class. If not, the OP plugin and RP plugin can not be installed together -->
<bean id="AbstractOIDCProfile" abstract="true"
p:securityConfiguration-ref="%{idp.security.authn.oidc.rp.config:shibboleth.authn.oidc.rp.DefaultSecurityConfiguration}" />
- <bean id="AbstractOIDCSSOProfile" parent="AbstractOIDCProfile" abstract="true" p:issuer-ref="issuer"
- p:tokenEndpointAuthMethods="%{idp.oidc.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}"
- p:forcePKCE="%{idp.authn.oidc.rp.forcePKCE:false}" p:allowPKCEPlain="%{idp.authn.oidc.rp.allowPKCEPlain:false}"
- p:iDTokenLifetime="%{idp.authn.oidc.rp.idToken.defaultLifetime:PT1H}"
- p:accessTokenLifetime="%{idp.authn.oidc.rp.accessToken.defaultLifetime:PT10M}"
- p:refreshTokenLifetime="%{idp.authn.oidc.rp.refreshToken.defaultLifetime:PT2H}"
- p:alwaysIncludedAttributes="%{idp.authn.oidc.rp.alwaysIncludedAttributes:}" />
+ <bean id="AbstractOIDCSSOProfile" parent="AbstractOIDCProfile" abstract="true"
+ p:issuer-ref="issuer"
+ p:tokenEndpointAuthMethods="%{idp.authn.oidc.rp.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}"/>
- <!-- FIXME This will NEED a new ID and possibly class. If not, the OP plugin and RP plugin can not be installed together -->
- <!-- Only load the default client_id and client_secret if discovery is disabled -->
- <bean id="OIDC.SSO" parent="AbstractOIDCSSOProfile" lazy-init="true"
+ <bean id="OIDC.SSO" parent="AbstractOIDCSSOProfile" lazy-init="true"
class="net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration"
p:httpRequestMethod="%{idp.authn.oidc.rp.httpRequestMethod:GET}"
p:authorizeCodeLifetime="%{idp.authn.oidc.rp.authorizeCode.defaultLifetime:PT5M}"
@@ -47,32 +42,24 @@
</property>
</bean>
- <!-- TODO Move this out to its own file? -->
- <util:map id="shibboleth.authn.oidc.rp.PrincipalProxyRequestMappings">
- <entry>
- <key>
- <bean parent="shibboleth.SAML2AuthnContextClassRef" c:classRef="http://example.org/ac/classes/mfa" />
- </key>
- <list>
- <bean class="net.shibboleth.oidc.authn.principal.AuthenticationContextClassReferencePrincipal"
- c:classRef="https://proxy.example.org/context2" />
- </list>
- </entry>
- </util:map>
- <!-- The default credential is based on the client_secret, and will be the only used credential in most cases -->
+ <!--
+ The default credential is based on the client_secret, and will be the only used credential in most cases.
+ It supports the 'direct encryption' key management mode by default, but can also be used for creating and
+ verifying MACs.
+ -->
<bean id="shibboleth.authn.oidc.rp.DefaultCredential" parent="shibboleth.authn.oidc.rp.ExpiringJWKCredential"
p:secret="%{idp.authn.oidc.rp.client.clientSecret:#{null}}"
p:keyNames="%{idp.authn.oidc.rp.client.clientSecretKeyName:defaultPropertiesClientSecret}"
p:alg="dir" />
- <!-- Security Configuration Defaults. These settings establish the default security configurations for signatures and
- loads the default credentials used. -->
-
- <!-- TODO change the signature config over to JWT -->
+ <!--
+ Security Configuration Defaults. These settings establish the default security configurations for
+ signatures and loads the default credentials used.
+ -->
<bean id="shibboleth.authn.oidc.rp.BasicSignatureValidationConfiguration" abstract="true"
- class="org.opensaml.xmlsec.impl.BasicSignatureValidationConfiguration"
+ class="net.shibboleth.oidc.security.impl.BasicSignatureValidationConfiguration"
p:includedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.IncludedSignatureAlgorithms')}"
p:excludedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.ExcludedSignatureAlgorithms')}" />
@@ -120,7 +107,6 @@
</property>
</bean>
- <!-- Configuration for supported algorithms for Request Object encryption. -->
<bean id="shibboleth.authn.oidc.rp.DefaultRequestObjectEncryptionConfiguration"
parent="shibboleth.authn.oidc.rp.BasicEncryptionConfiguration"
p:keyTransportEncryptionCredentials-ref="shibboleth.authn.oidc.rp.RequestObjectKeyTransportEncryptionCredentials"
@@ -167,8 +153,6 @@
</property>
</bean>
- <!-- Configuration for credentials and supported algorithms for request object request signing. Any shared secret credential
- from the RP's configuration will be included in the set of usable credentials -->
<bean id="shibboleth.authn.oidc.rp.DefaultRequestObjectSigningConfiguration"
parent="shibboleth.authn.oidc.rp.BasicSignatureSigningConfiguration"
p:signingCredentials-ref="shibboleth.authn.oidc.rp.SigningCredentials">
@@ -223,7 +207,9 @@
</constructor-arg>
</bean>
- <!-- A resolver to resolve pre-shared Direct Encryption key e.g. a pairwise client_secret from the input criterion -->
+ <!--
+ A resolver to resolve pre-shared Direct Encryption key e.g. a pairwise client_secret from the input criterion
+ -->
<bean id="defaultOIDCRPContentEncryptionKeyCredentialResolver"
class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
<constructor-arg>
@@ -234,15 +220,11 @@
</constructor-arg>
</bean>
- <!-- Configuration for supported algorithms for token endpoint authentication JWT signature validation. -->
- <!-- TODO This was a parent bean, but as that was not compatible with the new trust engine stuff, I moved to it's own
- class for now -->
<bean id="shibboleth.authn.oidc.rp.DefaultJWTSignatureValidationConfiguration"
- class="net.shibboleth.oidc.security.impl.BasicSignatureValidationConfiguration"
+ parent="shibboleth.authn.oidc.rp.BasicSignatureValidationConfiguration"
p:signatureTrustEngine-ref="ExplicitKeySignedJWTTrustEngine">
</bean>
-
<!-- A resolver for resolving trusted credentials to match against those resolved from the JWT -->
<bean id="defaultSignedJWTTrustedCredentialResolver"
class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
@@ -257,7 +239,7 @@
</constructor-arg>
</bean>
- <!-- A resolver for resolving Credentials out of the JOSE header of JWTs -->
+ <!-- A resolver for resolving credentials out of the JOSE header of JWTs -->
<bean id="defaultSignedJWTJOSEHeaderCredentialResolver"
class="net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver" />
diff --git a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp-config.xml b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp-config.xml
index 382e122..ed65094 100644
--- a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp-config.xml
+++ b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp-config.xml
@@ -1,18 +1,28 @@
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
- xmlns:context="http://www.springframework.org/schema/context"
- xmlns:util="http://www.springframework.org/schema/util"
- xmlns:p="http://www.springframework.org/schema/p"
- xmlns:c="http://www.springframework.org/schema/c"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ xmlns:context="http://www.springframework.org/schema/context"
+ xmlns:util="http://www.springframework.org/schema/util" xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:c="http://www.springframework.org/schema/c" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-
- default-init-method="initialize"
- default-destroy-method="destroy"
- default-lazy-init="true">
+
+ default-init-method="initialize" default-destroy-method="destroy" default-lazy-init="true">
+
+
+
+ <util:map id="shibboleth.authn.oidc.rp.PrincipalProxyRequestMappings">
+ <entry>
+ <key>
+ <bean parent="shibboleth.SAML2AuthnContextClassRef" c:classRef="http://example.org/ac/classes/mfa" />
+ </key>
+ <list>
+ <bean class="net.shibboleth.oidc.authn.principal.AuthenticationContextClassReferencePrincipal"
+ c:classRef="https://proxy.example.org/context2" />
+ </list>
+ </entry>
+ </util:map>
+
-
</beans>
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list