[java-idp-plugin-oidc-rp] branch main updated: Stub and in some cases populate the audit context actions
Phil Smart
philip.smart at jisc.ac.uk
Thu Aug 25 16:04:55 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=231aa8e011a3c6fe76f1f13774afdb1fe9a66d90
The following commit(s) were added to refs/heads/main by this push:
new 231aa8e Stub and in some cases populate the audit context actions
231aa8e is described below
commit 231aa8e011a3c6fe76f1f13774afdb1fe9a66d90
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Thu Aug 25 17:04:49 2022 +0100
Stub and in some cases populate the audit context actions
---
.../META-INF/net.shibboleth.idp/postconfig.xml | 53 ++++++++++++++++------
.../oidc-relying-party-authn-beans.xml | 38 ++++++++++++++--
.../oidc-relying-party-authn-flow.xml | 34 ++++++++++++--
.../idp/service/relying-party/postconfig.xml | 15 ------
.../authn/oidc/rp/conf/authn/rp-credentials.xml | 22 ++++++++-
.../plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java | 7 +--
.../test/resources/conf/authn/rp-credentials.xml | 10 ++++
7 files changed, 138 insertions(+), 41 deletions(-)
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 9583830..d19dd9a 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -9,7 +9,7 @@
default-init-method="initialize" default-destroy-method="destroy">
- <!-- System beans needed for extension to function, loaded after global.xml. -->
+ <!-- System beans needed for the extension to function, loaded after global.xml. -->
<bean id="shibboleth.authn.oidc.rp.JWKCredential" abstract="true"
class="net.shibboleth.oidc.security.impl.BasicJWKCredentialFactoryBean" />
@@ -117,7 +117,7 @@
<bean id="shibboleth.ChildLookup.Proxy.MessageContextLookup.Outbound"
class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.OutboundMessageContextFromProxyPRC"/>
- <!-- Alias to use in the flow config -->
+ <!-- Aliases to use in the flow config -->
<alias name="shibboleth.ChildLookup.Proxy.MessageContextLookup.Inbound" alias="InboundMessageContextFromRootPRC"/>
<alias name="shibboleth.ChildLookup.Proxy.MessageContextLookup.Outbound" alias="OutboundMessageContextFromRootPRC"/>
<alias name="shibboleth.ChildLookup.Proxy.ProxyProfileRequestContext" alias="ProxyProfileRequestContextLookup"/>
@@ -143,42 +143,35 @@
</property>
</bean>
+ <!-- TODO check this -->
<bean id="issuer" class="java.lang.String" c:_0="%{idp.authn.oidc.rp.issuer:%{idp.entityID}}" />
-
-
<!-- Necessary for encoder parsing and claims mapping to function. -->
-
<bean parent="shibboleth.RegistryNamingFunction" c:claz="net.minidev.json.JSONObject">
<constructor-arg name="function">
<bean class="net.shibboleth.oidc.attribute.transcoding.AbstractOIDCAttributeTranscoder.NamingFunction" />
</constructor-arg>
</bean>
- <!-- Controller implementation -->
+ <!-- Controller implementation to handle authorization request -->
<bean id="shibboleth.authn.OIDC.externalServletPath" class="java.lang.String"
c:_0="%{idp.authn.oidc.rp.externalAuthnPath:/Authn/OIDC/RP}">
</bean>
- <!-- location of the OIDC servlet authorization endpoint releative to the servlet -->
+ <!-- location of the OIDC servlet authorization endpoint relative to the servlet -->
<bean id="shibboleth.authn.OIDC.externalAuthnPath" class="java.lang.String"
c:_0="servletRelative:#{getObject('shibboleth.authn.OIDC.externalServletPath')}#{T(net.shibboleth.idp.plugin.authn.oidc.rp.impl.AuthorizationController).AUTHORIZE_PATH_SEGMENT}" />
<bean id="shibboleth.oidc.rp.AuthorizationController"
class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.AuthorizationController" />
-
- <!-- OIDC OP information resolver service beans. -->
-
+ <!-- OpenID Provider information resolver service beans. -->
<bean id="shibboleth.oidc.rp.ProviderMetadataResolver"
class="net.shibboleth.oidc.metadata.impl.ReloadingProviderMetadataProvider"
c:resolverService-ref="shibboleth.oidc.rp.ProviderMetadataResolverService" />
- <!-- TODO add this back? depends-on="shibboleth.AttributeResolverService" -->
-
<bean id="shibboleth.oidc.rp.ProviderMetadataResolverService"
class="net.shibboleth.ext.spring.service.ReloadableSpringService"
-
p:serviceConfigurations-ref="ExtendedProviderMetadataResolverResources"
p:failFast="%{idp.service.providermetadata.failFast:%{idp.service.failFast:false}}"
p:reloadCheckDelay="%{idp.service.providermetadata.checkInterval:PT0S}"
@@ -190,6 +183,7 @@
class="net.shibboleth.oidc.profile.spring.relyingparty.metadata.impl.ProviderMetadataResolverServiceStrategy" />
</constructor-arg>
</bean>
+
<!-- TODO ADD BACK THE CONDITION (GET TO WORK WITH TEST) <util:list id="shibboleth.DefaultProviderMetadataResolverResources">
<value>conditional:%{idp.home}/conf/oidc-providermetadata-resolvers.xml</value> OR <value>classpath:/conf/oidc-providermetadata-resolvers.xml</value>
</util:list> -->
@@ -217,5 +211,38 @@
p:httpClientSecurityParameters="#{getObject('shibboleth.oidc.rp.NonBrowser.HttpClientSecurityParameters')}" />
+ <!--
+ Add some auditors, should be in the audit-system.xml
+ -->
+
+ <bean id="shibboleth.oidc.rp.DefaultAuthenticationResponseAuditExtractors" lazy-init="true"
+ class="org.springframework.beans.factory.config.MapFactoryBean">
+ <property name="sourceMap">
+ <map>
+ <!-- No entries for now -->
+ </map>
+ </property>
+ </bean>
+
+
+ <bean id="shibboleth.oidc.rp.DefaultTokenResponseAuditExtractors" lazy-init="true"
+ class="org.springframework.beans.factory.config.MapFactoryBean">
+ <property name="sourceMap">
+ <map>
+ <!-- No entries for now -->
+ </map>
+ </property>
+ </bean>
+
+
+ <bean id="shibboleth.oidc.rp.DefaultUserInfoResponseAuditExtractors" lazy-init="true"
+ class="org.springframework.beans.factory.config.MapFactoryBean">
+ <property name="sourceMap">
+ <map>
+ <!-- No entries for now -->
+ </map>
+ </property>
+ </bean>
+
</beans>
\ No newline at end of file
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
index f362072..40182e4 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
@@ -37,12 +37,9 @@
<!-- Action beans -->
- <!-- Explicitly wrapped by a non-nested action adaptor. -->
-
- <!-- FIXME (add this back) p:profileId="#{T(net.shibboleth.idp.plugin.oidc.op.config.OIDCCoreProtocolConfiguration).PROFILE_ID}" -->
<bean id="InitializeProxyProfileRequestContext"
class="net.shibboleth.idp.authn.proxy.impl.InitializeProxyProfileRequestContext"
- p:profileId="http://shibboleth.net/ns/profiles/oidc/sso/browser"
+ p:profileId="#{T(net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration).PROFILE_ID}"
p:loggingId="%{idp.service.logging.oidcsso:OIDC.SSO}" p:browserProfile="true" />
<bean id="FlowStartPopulateAuditContext" parent="shibboleth.AbstractPopulateAuditContext"
@@ -100,6 +97,11 @@
<bean id="SelectProfileConfiguration" class="net.shibboleth.idp.profile.impl.SelectProfileConfiguration"
scope="prototype" p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext" />
+ <!-- TODO check shibboleth.oidc.rp is sensible in the getObjects -->
+ <bean id="PostLookupPopulateAuditContext" parent="shibboleth.AbstractPopulateAuditContext"
+ p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
+ p:fieldExtractors="#{getObject('shibboleth.oidc.rp.PostLookupAuditExtractors') ?: getObject('shibboleth.DefaultPostLookupAuditExtractors')}" />
+
<bean id="InitializeAuthorizationRequest"
class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.InitializeAuthorizationRequest" scope="prototype"
@@ -146,6 +148,21 @@
class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.AddForceAuthenticationPrompt"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
p:authenticationContextLookupStrategy-ref="ParentAuthenticiationContextLookup" />
+
+ <bean id="PostRequestPopulateAuditContext" parent="shibboleth.AbstractPopulateAuditContext"
+ p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
+ p:fieldExtractors="#{getObject('shibboleth.oidc.rp.PostRequestAuditExtractors') ?: getObject('shibboleth.DefaultPostRequestAuditExtractors')}" />
+
+ <bean id="AuthenticationResponsePopulateAuditContext" parent="shibboleth.AbstractPopulateAuditContext"
+ p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
+ p:fieldExtractors="#{getObject('shibboleth.oidc.rp.AuthenticationResponseAuditExtractors') ?: getObject('shibboleth.oidc.rp.DefaultAuthenticationResponseAuditExtractors')}" />
+
+ <bean id="WriteAuditLog" class="net.shibboleth.idp.profile.audit.impl.WriteAuditLog" scope="prototype"
+ p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
+ p:formattingMap-ref="shibboleth.AuditFormattingMap"
+ p:dateTimeFormat="#{getObject('shibboleth.AuditDateTimeFormat')}"
+ p:useDefaultTimeZone="#{getObject('shibboleth.AuditDefaultTimeZone') ?: false}"
+ p:httpServletRequest-ref="shibboleth.HttpServletRequest" />
<!-- Build RequestObject if required -->
<bean id="RequestObjectRequiredAndSupportedPredicate"
@@ -199,7 +216,8 @@
<bean id="shibboleth.authn.oidc.rp.EncryptionParametersResolver"
class="net.shibboleth.oidc.security.impl.ProviderMetadataEncryptionParametersResolver"
- p:remoteJwkSetCache-ref="shibboleth.authn.oidc.rp.RemoteJwkSetCache">
+ p:remoteJwkSetCache-ref="shibboleth.authn.oidc.rp.RemoteJwkSetCache"
+ p:keyFetchInterval="%{idp.authn.oidc.rp.provider.keyfetch.interval:PT30M}">
<property name="providerEncryptionMethodsLookupStrategy">
<bean class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.ProviderRequestObjectEncryptionMethodsLookupFunction"/>
</property>
@@ -640,6 +658,11 @@
<bean id="CheckUserInfoRequiredCondition"
class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic.UserInfoLookupCondition" />
+
+ <bean id="TokenResponsePopulateAuditContext" parent="shibboleth.AbstractPopulateAuditContext"
+ p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
+ p:fieldExtractors="#{getObject('shibboleth.oidc.rp.TokenResponseAuditExtractors') ?: getObject('shibboleth.oidc.rp.DefaultTokenResponseAuditExtractors')}" />
+
<!-- UserInfo endpoint beans -->
@@ -778,6 +801,11 @@
<ref bean="IssuerClaimsValidator" />
<ref bean="AudienceClaimsValidator" />
</util:list>
+
+ <bean id="UserInfoResponsePopulateAuditContext" parent="shibboleth.AbstractPopulateAuditContext"
+ p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
+ p:fieldExtractors="#{getObject('shibboleth.oidc.rp.UserInfoResponseAuditExtractors') ?: getObject('shibboleth.oidc.rp.DefaultUserInfoResponseAuditExtractors')}" />
+
<!-- This is a very simplified and hard coded version of the claims verification used for a JWT. Maybe look to replace -->
<bean id="ValidateUserInfoPlainResponseClaims" scope="prototype"
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-flow.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-flow.xml
index dfecc48..84aa7f9 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-flow.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-flow.xml
@@ -31,7 +31,7 @@
<evaluate expression="InitializeRelyingPartyContext" />
<evaluate expression="SelectRelyingPartyConfiguration" />
- <!-- <evaluate expression="PostLookupPopulateAuditContext" /> -->
+ <evaluate expression="PostLookupPopulateAuditContext" />
<evaluate expression="InitializeOutboundMessageContext" />
<evaluate expression="SelectProfileConfiguration" />
<evaluate expression="InitializeOAuth2ClientContext" />
@@ -44,8 +44,8 @@
<evaluate expression="AddRequestedClaims" />
<evaluate expression="AddRedirectURI"/>
<evaluate expression="AddAuthenticationContextClassReferences" />
- <!-- <evaluate expression="PostRequestPopulateAuditContext" /> -->
- <!-- <evaluate expression="WriteAuditLog" /> -->
+ <evaluate expression="PostRequestPopulateAuditContext" />
+ <evaluate expression="WriteAuditLog" />
<!-- <evaluate expression="InitializeMessageChannelSecurityContext" /> -->
<evaluate expression="'proceed'" />
@@ -82,8 +82,10 @@
<transition to="ValidateResponse" />
</view-state>
+ <!-- Generally validate the response, in a way that is agnostic to the grant_type -->
<action-state id="ValidateResponse">
<evaluate expression="ValidateExternalAuthenticationContext" />
+ <evaluate expression="AuthenticationResponsePopulateAuditContext" />
<evaluate expression="ValidateAuthenticationResponseResult" />
<evaluate expression="ValidateResponseStateMatchesRequest" />
<!--
@@ -94,6 +96,9 @@
<evaluate expression="AddPeerEntityContextToInboundMessage" />
<evaluate expression="'proceed'" />
<transition on="proceed" to="SwitchOnGrantType" />
+ <on-exit>
+ <evaluate expression="WriteAuditLog" />
+ </on-exit>
</action-state>
<!-- Switch flow path based on OIDC grant_type used. Only code flow is actually supported currently. -->
@@ -106,7 +111,7 @@
then="ImplicitFlow" else="UnsupportedFlow" />
</decision-state>
- <action-state id="CodeFlow">
+ <action-state id="CodeFlow">
<evaluate expression="InitializeOAuth2ClientAuthenticationContext" />
<evaluate expression="ExchangeCodeForAccessToken" />
<evaluate expression="ValidateOAuthAccessTokenResponse" />
@@ -117,8 +122,12 @@
<!-- TODO Not sure if HandleIDTokenValidation needs to be a message chain? -->
<evaluate expression="HandleIDTokenValidation" />
<evaluate expression="ValidateIDTokenClaims" />
+ <evaluate expression="TokenResponsePopulateAuditContext" />
<evaluate expression="'proceed'" />
<transition on="proceed" to="CheckUserInfoClaimsRequired" />
+ <on-exit>
+ <evaluate expression="WriteAuditLog" />
+ </on-exit>
</action-state>
@@ -148,21 +157,30 @@
<evaluate expression="PopulateUserInfoTokenSignatureValidationParameters" />
<evaluate expression="HandleUserInfoTokenValidation" />
<evaluate expression="ValidateUserInfoTokenClaims" />
+ <evaluate expression="UserInfoResponsePopulateAuditContext" />
<evaluate expression="'proceed'" />
<transition on="proceed" to="FinalizeResponse" />
+ <on-exit>
+ <evaluate expression="WriteAuditLog" />
+ </on-exit>
</action-state>
<!-- Plain UserInfo response types will skip straight to this stage -->
<action-state id="ValidateUserInfoPlainClaimsSet">
<evaluate expression="ValidateUserInfoPlainResponseClaims" />
+ <evaluate expression="UserInfoResponsePopulateAuditContext" />
<evaluate expression="'proceed'" />
<transition on="proceed" to="FinalizeResponse" />
+ <on-exit>
+ <evaluate expression="WriteAuditLog" />
+ </on-exit>
</action-state>
<action-state id="FinalizeResponse">
<evaluate expression="ProcessEndUserClaims" />
<evaluate expression="ValidateOIDCAuthentication" />
<evaluate expression="'proceed'" />
+ <!-- Subject canonicalization -->
<transition on="proceed" to="proceed" />
</action-state>
@@ -181,6 +199,14 @@
<evaluate expression="'proceed'" />
<transition on="proceed" to="END" />
</action-state>
+
+ <!-- <subflow-state id="CallSubjectCanonicalization" subflow="c14n">
+ <input name="calledAsSubflow" value="true" />
+ <transition on="proceed" to="proceed" />
+
+ This shouldn't generally happen, but if c14n fails, it's allowable to fall through.
+ <transition on="SubjectCanonicalizationError" to="ReselectFlow" />
+ </subflow-state> -->
<bean-import resource="oidc-relying-party-authn-beans.xml" />
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index 83b52d8..4c3a09b 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -22,10 +22,6 @@
<bean id="OIDC.SSO" parent="AbstractOIDCSSOProfile" lazy-init="true"
class="net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration"
p:httpRequestMethod="%{idp.authn.oidc.rp.httpRequestMethod:GET}"
- p:authorizeCodeLifetime="%{idp.authn.oidc.rp.authorizeCode.defaultLifetime:PT5M}"
- p:encodeConsentInTokens="%{idp.authn.oidc.rp.encodeConsentInTokens:false}"
- p:encodedAttributes="%{idp.authn.oidc.rp.encodedAttributes:%{idp.oidc.embeddedAttributes:}}"
- p:deniedUserInfoAttributes="%{idp.authn.oidc.rp.deniedUserInfoAttributes:}"
p:clientId="#{%{idp.authn.oidc.rp.discoveryRequired:false} == true ? null : '%{idp.authn.oidc.rp.client.clientId:}'}"
p:clientCredential="#{%{idp.authn.oidc.rp.discoveryRequired:false} == true ? {null} : getObject('shibboleth.authn.oidc.rp.DefaultCredential')}"
p:tokenEndpointAuthMethods="%{idp.authn.oidc.rp.clientAuthenticationMethod:client_secret_basic}"
@@ -43,17 +39,6 @@
</bean>
- <!--
- The default credential is based on the client_secret, and will be the only used credential in most cases.
- It supports the 'direct encryption' key management mode by default, but can also be used for creating and
- verifying MACs.
- -->
- <bean id="shibboleth.authn.oidc.rp.DefaultCredential" parent="shibboleth.authn.oidc.rp.ExpiringJWKCredential"
- p:secret="%{idp.authn.oidc.rp.client.clientSecret:#{null}}"
- p:keyNames="%{idp.authn.oidc.rp.client.clientSecretKeyName:defaultPropertiesClientSecret}"
- p:alg="dir" />
-
-
<!--
Security Configuration Defaults. These settings establish the default security configurations for
signatures and loads the default credentials used.
diff --git a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/rp-credentials.xml b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/rp-credentials.xml
index d660e13..a0c7b15 100644
--- a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/rp-credentials.xml
+++ b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/rp-credentials.xml
@@ -8,6 +8,16 @@
http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
default-init-method="initialize" default-destroy-method="destroy">
+
+ <!--
+ The default credential is based on the client_secret, and will be the only used credential in most cases.
+ It supports the 'direct encryption' key management mode by default, but can also be used for creating and
+ verifying MACs.
+ -->
+ <bean id="shibboleth.authn.oidc.rp.DefaultCredential" parent="shibboleth.authn.oidc.rp.ExpiringJWKCredential"
+ p:secret="%{idp.authn.oidc.rp.client.clientSecret:#{null}}"
+ p:keyNames="%{idp.authn.oidc.rp.client.clientSecretKeyName:defaultPropertiesClientSecret}"
+ p:alg="dir" />
<!-- Your RP's default encryption (really decryption) keys, set via property file. -->
<util:list id="shibboleth.authn.oidc.rp.DefaultKeyEncryptionCredentials">
@@ -15,8 +25,18 @@
p:resource="%{idp.authn.oidc.rp.client.enc.key:#{null}}" />
</util:list>
+ <util:list id="shibboleth.authn.oidc.rp.DefaultRequestObjectKeyTransportEncryptionCredentials">
+ <bean parent="shibboleth.authn.oidc.rp.JWKCredential" p:failIfResourceIsNull="false"
+ p:resource="%{idp.authn.oidc.rp.client.requestobject.enc.symmetric.kw.key:#{null}}" />
+ </util:list>
+
+ <util:list id="shibboleth.authn.oidc.rp.DefaultRequestObjectDataEncryptionCredentials">
+ <bean parent="shibboleth.authn.oidc.rp.JWKCredential" p:failIfResourceIsNull="false"
+ p:resource="%{idp.authn.oidc.rp.client.requestobject.enc.symmetric.cek.key:#{null}}" />
+ </util:list>
+
<!-- Default signing credentials -->
- <util:list id="shibboleth.authn.oidc.rp.SigningCredentials">
+ <util:list id="shibboleth.authn.oidc.rp.DefaultSigningCredentials">
<bean parent="shibboleth.authn.oidc.rp.JWKCredential" p:failIfResourceIsNull="false"
p:resource="%{idp.authn.oidc.rp.client.sig.key:#{null}}" />
</util:list>
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java
index 5eeee7b..135ba3c 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java
@@ -34,6 +34,7 @@ import org.apache.http.conn.ssl.TrustAllStrategy;
import org.apache.http.impl.client.HttpClients;
import org.apache.http.ssl.SSLContextBuilder;
import org.junit.Test;
+import org.mockito.Mockito;
import org.opensaml.core.config.InitializationException;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.profile.context.ProfileRequestContext;
@@ -267,7 +268,6 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
.setInitMethodName("initialize")
.getBeanDefinition());
-
addBeanDefinition(builderContext, "shibboleth.SAML2AuthnContextClassRef",BeanDefinitionBuilder.
genericBeanDefinition(net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal.class)
.setAbstract(true).getBeanDefinition());
@@ -309,8 +309,7 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
loadBeanDefinitionsFromXmlFile(builderContext,
new ClassPathResource("conf/test-relyingparty-resolver-service.xml"),
Map.of("idp.authn.oidc.rp.client.clientId", CLIENT_ID,
- "idp.authn.oidc.rp.client.redirectURL", REDIRECT_URI_OVERRIDE,
- "idp.authn.oidc.rp.client.clientSecret",CLIENT_SECRET));
+ "idp.authn.oidc.rp.client.redirectURL", REDIRECT_URI_OVERRIDE));
loadBeanDefinitionsFromXmlFile(builderContext,
new ClassPathResource("conf/additional-system-beans.xml"), null);
@@ -324,6 +323,8 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
// Add a signing key incase it is used
loadBeanDefinitionsFromXmlFile(builderContext,
new ClassPathResource("conf/authn/rp-credentials.xml"), Map.of(
+ "idp.authn.oidc.rp.client.clientId", CLIENT_ID,
+ "idp.authn.oidc.rp.client.clientSecret",CLIENT_SECRET,
"idp.authn.oidc.rp.client.sig.key","conf/credentials/idp-signing-rsa.jwk"));
}
diff --git a/idp-oidc-rp-impl/src/test/resources/conf/authn/rp-credentials.xml b/idp-oidc-rp-impl/src/test/resources/conf/authn/rp-credentials.xml
index 8c8a19d..a0c7b15 100644
--- a/idp-oidc-rp-impl/src/test/resources/conf/authn/rp-credentials.xml
+++ b/idp-oidc-rp-impl/src/test/resources/conf/authn/rp-credentials.xml
@@ -8,6 +8,16 @@
http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
default-init-method="initialize" default-destroy-method="destroy">
+
+ <!--
+ The default credential is based on the client_secret, and will be the only used credential in most cases.
+ It supports the 'direct encryption' key management mode by default, but can also be used for creating and
+ verifying MACs.
+ -->
+ <bean id="shibboleth.authn.oidc.rp.DefaultCredential" parent="shibboleth.authn.oidc.rp.ExpiringJWKCredential"
+ p:secret="%{idp.authn.oidc.rp.client.clientSecret:#{null}}"
+ p:keyNames="%{idp.authn.oidc.rp.client.clientSecretKeyName:defaultPropertiesClientSecret}"
+ p:alg="dir" />
<!-- Your RP's default encryption (really decryption) keys, set via property file. -->
<util:list id="shibboleth.authn.oidc.rp.DefaultKeyEncryptionCredentials">
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list