[java-idp-oidc] branch main updated: Cleanup signature parameter action metadata lookup.
Scott Cantor
cantor.2 at osu.edu
Mon Feb 14 16:18:00 UTC 2022
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=efee70961ce54a42bf4e25a289a79862598e438c
The following commit(s) were added to refs/heads/main by this push:
new efee7096 Cleanup signature parameter action metadata lookup.
efee7096 is described below
commit efee70961ce54a42bf4e25a289a79862598e438c
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Feb 14 11:17:57 2022 -0500
Cleanup signature parameter action metadata lookup.
---
.../PopulateOIDCSignatureSigningParameters.java | 56 ++++++++++++-------
...ulateOIDCSignatureSigningParametersHandler.java | 63 ++++++++++++----------
.../idp/flows/oidc/authorize/authorize-beans.xml | 2 +
.../idp/flows/oidc/token/token-beans.xml | 26 ++++-----
.../idp/flows/oidc/userinfo/userinfo-beans.xml | 1 +
5 files changed, 88 insertions(+), 60 deletions(-)
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/PopulateOIDCSignatureSigningParameters.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/PopulateOIDCSignatureSigningParameters.java
index 4f84a09b..2f9cc2f8 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/PopulateOIDCSignatureSigningParameters.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/PopulateOIDCSignatureSigningParameters.java
@@ -24,14 +24,12 @@ import java.util.function.Function;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
+import org.opensaml.messaging.context.MessageContext;
+import org.opensaml.messaging.context.navigate.ContextDataLookupFunction;
import org.opensaml.profile.action.AbstractHandlerDelegatingProfileAction;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
-import org.opensaml.profile.context.navigate.OutboundMessageContextLookup;
import org.opensaml.saml.common.messaging.context.SAMLMetadataContext;
-import org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext;
import org.opensaml.saml.common.profile.impl.PopulateSignatureSigningParameters;
import org.opensaml.xmlsec.SecurityConfigurationSupport;
import org.opensaml.xmlsec.SignatureSigningConfiguration;
@@ -41,6 +39,8 @@ import org.opensaml.xmlsec.context.SecurityParametersContext;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCMetadataContext;
+import net.shibboleth.utilities.java.support.annotation.ParameterName;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
@@ -63,7 +63,8 @@ public class PopulateOIDCSignatureSigningParameters
@Nonnull private final Logger log = LoggerFactory.getLogger(PopulateOIDCSignatureSigningParameters.class);
/** Strategy used to look up the {@link SecurityParametersContext} to set the parameters for. */
- @Nonnull private Function<ProfileRequestContext, SecurityParametersContext> securityParametersContextLookupStrategy;
+ @Nullable
+ private Function<ProfileRequestContext, SecurityParametersContext> securityParametersContextLookupStrategy;
/** Strategy used to look up an existing {@link SecurityParametersContext} to copy. */
@Nullable private Function<ProfileRequestContext,SecurityParametersContext> existingParametersContextLookupStrategy;
@@ -75,6 +76,9 @@ public class PopulateOIDCSignatureSigningParameters
/** Strategy used to look up a SAML metadata context. */
@Nullable private Function<ProfileRequestContext, SAMLMetadataContext> metadataContextLookupStrategy;
+ /** Strategy used to look up a OIDC metadata context. */
+ @Nullable private Function<MessageContext, OIDCMetadataContext> oidcMetadataContextLookupStrategy;
+
/** Resolver for parameters to store into context. */
@NonnullAfterInit private SignatureSigningParametersResolver resolver;
@@ -83,19 +87,12 @@ public class PopulateOIDCSignatureSigningParameters
/**
* Constructor.
+ *
+ * @param strategy lookup strategy for message context
*/
- public PopulateOIDCSignatureSigningParameters() {
- super(PopulateOIDCSignatureSigningParametersHandler.class, new OutboundMessageContextLookup());
-
- // Create context by default.
- securityParametersContextLookupStrategy =
- new ChildContextLookup<>(SecurityParametersContext.class, true).compose(
- new OutboundMessageContextLookup());
-
- // Default: outbound msg context -> SAMLPeerEntityContext -> SAMLMetadataContext
- metadataContextLookupStrategy = new ChildContextLookup<>(SAMLMetadataContext.class).compose(
- new ChildContextLookup<>(SAMLPeerEntityContext.class).compose(
- new InboundMessageContextLookup()));
+ public PopulateOIDCSignatureSigningParameters(@ParameterName(name = "strategy")
+ @Nonnull final ContextDataLookupFunction<ProfileRequestContext,MessageContext> strategy) {
+ super(PopulateOIDCSignatureSigningParametersHandler.class, strategy);
setErrorEvent(EventIds.INVALID_SEC_CFG);
}
@@ -138,6 +135,20 @@ public class PopulateOIDCSignatureSigningParameters
metadataContextLookupStrategy = strategy;
}
+ /**
+ * Set lookup strategy for {@link OIDCMetadataContext} for input to resolution.
+ *
+ * @param strategy lookup strategy
+ *
+ * @since 3.1.0
+ */
+ public void setOidcMetadataContextLookupStrategy(
+ @Nullable final Function<MessageContext,OIDCMetadataContext> strategy) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ oidcMetadataContextLookupStrategy = strategy;
+ }
+
/**
* Set the strategy used to look up a per-request {@link SignatureSigningConfiguration} list.
*
@@ -199,9 +210,16 @@ public class PopulateOIDCSignatureSigningParameters
delegate.setNoResultIsError(noResultIsError);
delegate.setSignatureSigningParametersResolver(resolver);
delegate.setConfigurationLookupStrategy(adapt(configurationLookupStrategy));
- delegate.setSecurityParametersContextLookupStrategy(adapt(securityParametersContextLookupStrategy));
+ if (securityParametersContextLookupStrategy != null) {
+ delegate.setSecurityParametersContextLookupStrategy(adapt(securityParametersContextLookupStrategy));
+ }
delegate.setExistingParametersContextLookupStrategy(adapt(existingParametersContextLookupStrategy));
- delegate.setMetadataContextLookupStrategy(adapt(metadataContextLookupStrategy));
+ if (metadataContextLookupStrategy != null) {
+ delegate.setMetadataContextLookupStrategy(adapt(metadataContextLookupStrategy));
+ }
+ if (oidcMetadataContextLookupStrategy != null) {
+ delegate.setOidcMetadataContextLookupStrategy(oidcMetadataContextLookupStrategy);
+ }
delegate.initialize();
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/PopulateOIDCSignatureSigningParametersHandler.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/PopulateOIDCSignatureSigningParametersHandler.java
index 812b09dd..3b1c5e71 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/PopulateOIDCSignatureSigningParametersHandler.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/PopulateOIDCSignatureSigningParametersHandler.java
@@ -26,10 +26,8 @@ import javax.annotation.Nullable;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
-import org.opensaml.messaging.context.navigate.ParentContextLookup;
import org.opensaml.messaging.handler.AbstractMessageHandler;
import org.opensaml.messaging.handler.MessageHandlerException;
-import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.saml.common.binding.impl.PopulateSignatureSigningParametersHandler;
import org.opensaml.saml.common.messaging.context.SAMLMetadataContext;
import org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext;
@@ -45,7 +43,6 @@ import org.slf4j.LoggerFactory;
import net.shibboleth.idp.plugin.oidc.op.criterion.ClientInformationCriterion;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCMetadataContext;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultOIDCMetadataContextLookupFunction;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
@@ -78,7 +75,10 @@ public class PopulateOIDCSignatureSigningParametersHandler extends AbstractMessa
@NonnullAfterInit private Function<MessageContext, List<SignatureSigningConfiguration>> configurationLookupStrategy;
/** Strategy used to look up a SAML metadata context. */
- @Nullable private Function<MessageContext, SAMLMetadataContext> metadataContextLookupStrategy;
+ @Nonnull private Function<MessageContext, SAMLMetadataContext> metadataContextLookupStrategy;
+
+ /** Strategy used to look up a OIDC metadata context. */
+ @Nonnull private Function<MessageContext, OIDCMetadataContext> oidcMetadataContextLookupStrategy;
/** Resolver for parameters to store into context. */
@NonnullAfterInit private SignatureSigningParametersResolver resolver;
@@ -86,9 +86,6 @@ public class PopulateOIDCSignatureSigningParametersHandler extends AbstractMessa
/** Whether failure to resolve parameters should be raised as an error. */
private boolean noResultIsError;
- /** Strategy used to look up a OIDC metadata context. */
- @Nullable private Function<MessageContext, OIDCMetadataContext> oidcMetadataContextLookupStrategy;
-
/**
* Constructor.
*/
@@ -96,8 +93,8 @@ public class PopulateOIDCSignatureSigningParametersHandler extends AbstractMessa
// Create context by default.
securityParametersContextLookupStrategy = new ChildContextLookup<>(SecurityParametersContext.class, true);
- oidcMetadataContextLookupStrategy = new DefaultOIDCMetadataContextLookupFunction().compose(
- new ParentContextLookup<>(ProfileRequestContext.class));
+ // Locate directly under input context.
+ oidcMetadataContextLookupStrategy = new ChildContextLookup<>(OIDCMetadataContext.class);
// Default: msg context -> SAMLPeerEntityContext -> SAMLMetadataContext
metadataContextLookupStrategy = new ChildContextLookup<>(SAMLMetadataContext.class).compose(
@@ -135,11 +132,27 @@ public class PopulateOIDCSignatureSigningParametersHandler extends AbstractMessa
*
* @param strategy lookup strategy
*/
- public void
- setMetadataContextLookupStrategy(@Nullable final Function<MessageContext, SAMLMetadataContext> strategy) {
+ public void setMetadataContextLookupStrategy(
+ @Nonnull final Function<MessageContext,SAMLMetadataContext> strategy) {
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- metadataContextLookupStrategy = strategy;
+ metadataContextLookupStrategy =
+ Constraint.isNotNull(strategy, "SAMLMetadataContext lookup strategy cannot be null");
+ }
+
+ /**
+ * Set lookup strategy for {@link OIDCMetadataContext} for input to resolution.
+ *
+ * @param strategy lookup strategy
+ *
+ * @since 3.1.0
+ */
+ public void setOidcMetadataContextLookupStrategy(
+ @Nonnull final Function<MessageContext,OIDCMetadataContext> strategy) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ oidcMetadataContextLookupStrategy =
+ Constraint.isNotNull(strategy, "OIDCMetadataContext lookup strategy cannot be null");
}
/**
@@ -243,26 +256,20 @@ public class PopulateOIDCSignatureSigningParametersHandler extends AbstractMessa
final CriteriaSet criteria = new CriteriaSet(new SignatureSigningConfigurationCriterion(configs));
- if (metadataContextLookupStrategy != null) {
- final SAMLMetadataContext metadataCtx = metadataContextLookupStrategy.apply(messageContext);
- if (metadataCtx != null && metadataCtx.getRoleDescriptor() != null) {
- log.debug("{} Adding metadata to resolution criteria for signing/digest algorithms", getLogPrefix());
- criteria.add(new RoleDescriptorCriterion(metadataCtx.getRoleDescriptor()));
- }
+ final SAMLMetadataContext metadataCtx = metadataContextLookupStrategy.apply(messageContext);
+ if (metadataCtx != null && metadataCtx.getRoleDescriptor() != null) {
+ log.debug("{} Adding metadata to resolution criteria for signing/digest algorithms", getLogPrefix());
+ criteria.add(new RoleDescriptorCriterion(metadataCtx.getRoleDescriptor()));
}
// The addition to {@link PopulateSignatureSigningParametersHandler}
- if (oidcMetadataContextLookupStrategy != null) {
- final OIDCMetadataContext oidcMetadataCtx = oidcMetadataContextLookupStrategy.apply(messageContext);
- if (oidcMetadataCtx != null && oidcMetadataCtx.getClientInformation() != null) {
- log.debug("{} Adding oidc client information to resolution criteria for signing/digest algorithms",
- getLogPrefix());
- criteria.add(new ClientInformationCriterion(oidcMetadataCtx.getClientInformation()));
- } else {
- log.debug("{} oidcMetadataCtx is null", getLogPrefix());
- }
+ final OIDCMetadataContext oidcMetadataCtx = oidcMetadataContextLookupStrategy.apply(messageContext);
+ if (oidcMetadataCtx != null && oidcMetadataCtx.getClientInformation() != null) {
+ log.debug("{} Adding OIDC client information to resolution criteria for signing/digest algorithms",
+ getLogPrefix());
+ criteria.add(new ClientInformationCriterion(oidcMetadataCtx.getClientInformation()));
} else {
- log.debug("{} oidcMetadataContextLookupStrategy is null", getLogPrefix());
+ log.debug("{} OIDCMetadataContext is absent", getLogPrefix());
}
try {
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
index 6fea194a..8b453c92 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
@@ -75,6 +75,7 @@
<bean id="PopulateRequestObjectSignatureValidationParameters"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.PopulateOIDCSignatureSigningParameters " scope="prototype"
+ c:strategy-ref="shibboleth.MessageContextLookup.Inbound"
p:configurationLookupStrategy-ref="shibboleth.oidc.SignatureValidationConfigurationLookup"
p:signatureSigningParametersResolver-ref="shibboleth.oidc.RequestObjectSignatureValidationParametersResolver">
<property name="securityParametersContextLookupStrategy">
@@ -176,6 +177,7 @@
<bean id="PopulateIDTokenSignatureSigningParameters"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.PopulateOIDCSignatureSigningParameters " scope="prototype"
+ c:strategy-ref="shibboleth.MessageContextLookup.Inbound"
p:configurationLookupStrategy-ref="shibboleth.SignatureSigningConfigurationLookup"
p:signatureSigningParametersResolver-ref="shibboleth.oidc.TokenSignatureSigningParametersResolver">
<property name="activationCondition">
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
index f6a04206..ffeafeab 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
@@ -40,8 +40,9 @@
scope="prototype" />
<bean id="PopulateTokenEndpointJwtSignatureValidationParameters"
- class="net.shibboleth.idp.plugin.oidc.op.profile.impl.PopulateOIDCSignatureSigningParameters "
+ class="net.shibboleth.idp.plugin.oidc.op.profile.impl.PopulateOIDCSignatureSigningParameters"
scope="prototype"
+ c:strategy-ref="shibboleth.MessageContextLookup.Inbound"
p:configurationLookupStrategy-ref="shibboleth.oidc.SignatureValidationConfigurationLookup"
p:signatureSigningParametersResolver-ref="shibboleth.oidc.TokenEndpointJwtSignatureValidationParametersResolver">
<property name="securityParametersContextLookupStrategy">
@@ -258,19 +259,15 @@
scope="prototype" />
</constructor-arg>
</bean>
-
- <bean id="LookupPeerEntityContext" parent="shibboleth.Functions.Compose"
- c:g-ref="shibboleth.ChildLookup.SAMLPeerEntityContext"
- c:f-ref="shibboleth.MessageContextLookup.Outbound"/>
-
- <bean id="LookupSAMLMetadataContext" parent="shibboleth.Functions.Compose"
- c:g-ref="shibboleth.ChildLookup.SAMLMetadataContext"
- c:f-ref="LookupPeerEntityContext"/>
<bean id="InitializeAudienceRelyingPartyContextFromSAMLPeer"
class="net.shibboleth.idp.saml.profile.impl.InitializeRelyingPartyContextFromSAMLPeer" scope="prototype"
p:relyingPartyContextCreationStrategy-ref="AudienceRelyingPartyCreationStrategy"
- p:peerEntityContextLookupStrategy-ref="LookupPeerEntityContext" />
+ p:peerEntityContextLookupStrategy-ref="LookupOutboundPeerEntityContext" />
+
+ <bean id="LookupOutboundPeerEntityContext" parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.ChildLookup.SAMLPeerEntityContext"
+ c:f-ref="shibboleth.MessageContextLookup.Outbound"/>
<bean id="SelectAudienceRelyingPartyConfiguration"
class="net.shibboleth.idp.profile.impl.SelectRelyingPartyConfiguration" scope="prototype"
@@ -317,7 +314,9 @@
<!-- Traditional third-party grant response handling. -->
<bean id="PopulateIDTokenSignatureSigningParameters"
- class="net.shibboleth.idp.plugin.oidc.op.profile.impl.PopulateOIDCSignatureSigningParameters" scope="prototype"
+ class="net.shibboleth.idp.plugin.oidc.op.profile.impl.PopulateOIDCSignatureSigningParameters"
+ scope="prototype"
+ c:strategy-ref="shibboleth.MessageContextLookup.Inbound"
p:configurationLookupStrategy-ref="shibboleth.SignatureSigningConfigurationLookup"
p:signatureSigningParametersResolver-ref="shibboleth.oidc.TokenSignatureSigningParametersResolver">
<property name="securityParametersContextLookupStrategy">
@@ -410,10 +409,11 @@
<!-- client_credentials grant response actions. -->
<bean id="PopulateAccessTokenSignatureSigningParameters"
- class="net.shibboleth.idp.plugin.oidc.op.profile.impl.PopulateOIDCSignatureSigningParameters" scope="prototype"
+ class="net.shibboleth.idp.plugin.oidc.op.profile.impl.PopulateOIDCSignatureSigningParameters"
+ scope="prototype"
+ c:strategy-ref="shibboleth.MessageContextLookup.Outbound"
p:configurationLookupStrategy-ref="shibboleth.SignatureSigningConfigurationLookup"
p:signatureSigningParametersResolver-ref="shibboleth.oidc.TokenSignatureSigningParametersResolver"
- p:metadataContextLookupStrategy-ref="LookupSAMLMetadataContext"
p:securityParametersContextLookupStrategy-ref="AudienceSecurityParametersCreationStrategy">
<property name="existingParametersContextLookupStrategy">
<bean parent="shibboleth.Functions.Compose"
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-beans.xml
index e902612a..fc54a65b 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-beans.xml
@@ -60,6 +60,7 @@
<bean id="PopulateUserInfoResponseSignatureSigningParameters"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.PopulateOIDCSignatureSigningParameters " scope="prototype"
+ c:strategy-ref="shibboleth.MessageContextLookup.Inbound"
p:configurationLookupStrategy-ref="shibboleth.SignatureSigningConfigurationLookup"
p:signatureSigningParametersResolver-ref="shibboleth.oidc.UserInfoSignatureSigningParametersResolver">
<property name="securityParametersContextLookupStrategy">
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list