[java-idp-oidc] branch main updated: Add default scope/audience fallback settings.
Scott Cantor
cantor.2 at osu.edu
Mon Feb 14 18:40:25 UTC 2022
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=7bf5c95a477470ca34987a5704b4f1004bf1f088
The following commit(s) were added to refs/heads/main by this push:
new 7bf5c95a Add default scope/audience fallback settings.
7bf5c95a is described below
commit 7bf5c95a477470ca34987a5704b4f1004bf1f088
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Feb 14 13:40:22 2022 -0500
Add default scope/audience fallback settings.
---
.../navigate/ClientInfoAudienceLookupFunction.java | 18 ++++++++++++---
.../navigate/ClientInfoScopeLookupFunction.java | 27 +++++++++++++++++++---
.../META-INF/net.shibboleth.idp/postconfig.xml | 6 +++--
.../idp/plugin/oidc/op/conf/oidc.properties | 4 ++++
4 files changed, 47 insertions(+), 8 deletions(-)
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ClientInfoAudienceLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ClientInfoAudienceLookupFunction.java
index 0e24f991..b2e247af 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ClientInfoAudienceLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ClientInfoAudienceLookupFunction.java
@@ -31,6 +31,7 @@ import org.slf4j.LoggerFactory;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCMetadataContext;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
+import net.shibboleth.utilities.java.support.primitive.StringSupport;
/** A function that returns {@link OIDCMetadataContext}. */
public class ClientInfoAudienceLookupFunction implements ContextDataLookupFunction<OIDCMetadataContext,List<String>> {
@@ -38,11 +39,22 @@ public class ClientInfoAudienceLookupFunction implements ContextDataLookupFuncti
/** Class logger. */
@Nonnull private Logger log = LoggerFactory.getLogger(ClientInfoAudienceLookupFunction.class);
+ /** Default audience in the absence of metadata. */
+ @Nullable @NonnullElements private List<String> defaultAudience;
+
+ /**
+ * Set default audience to return in the absence of client metadata.
+ *
+ * @param audience default audience
+ */
+ public void setDefaultAudience(@Nullable @NonnullElements final Collection<String> audience) {
+ defaultAudience = List.copyOf(StringSupport.normalizeStringCollection(audience));
+ }
+
/** {@inheritDoc} */
- @Nullable @NonnullElements
- public List<String> apply(@Nullable final OIDCMetadataContext input) {
+ @Nullable @NonnullElements public List<String> apply(@Nullable final OIDCMetadataContext input) {
if (input == null || input.getClientInformation() == null) {
- return null;
+ return defaultAudience;
}
final Object obj = input.getClientInformation().getMetadata().getCustomField("audience");
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ClientInfoScopeLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ClientInfoScopeLookupFunction.java
index ff5451f9..d07ee758 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ClientInfoScopeLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ClientInfoScopeLookupFunction.java
@@ -24,15 +24,36 @@ import org.opensaml.messaging.context.navigate.ContextDataLookupFunction;
import com.nimbusds.oauth2.sdk.Scope;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCMetadataContext;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
/** A function that returns {@link OIDCMetadataContext}. */
public class ClientInfoScopeLookupFunction implements ContextDataLookupFunction<OIDCMetadataContext,Scope> {
+ /** Default to use if no metadata exists. */
+ @Nullable private Scope defaultScope;
+
+ /**
+ * Set the default {@link Scope} to return in the absence of client metadata.
+ *
+ * @param scope default scope
+ */
+ public void setDefaultScope(@Nullable final Scope scope) {
+ defaultScope = scope;
+ }
+
+ /**
+ * Set the default {@link Scope} to return in the absence of client metadata.
+ *
+ * @param scope default scope in string form
+ */
+ public void setDefaultScope(@Nullable @NonnullElements final String scope) {
+ defaultScope = Scope.parse(scope);
+ }
+
/** {@inheritDoc} */
- @Nullable
- public Scope apply(@Nullable final OIDCMetadataContext input) {
+ @Nullable public Scope apply(@Nullable final OIDCMetadataContext input) {
if (input == null || input.getClientInformation() == null) {
- return null;
+ return defaultScope;
}
return input.getClientInformation().getMetadata().getScope();
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index d36c2058..bb38eac3 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -211,7 +211,8 @@
-->
<bean id="shibboleth.oidc.DefaultAllowedScopeStrategy" parent="shibboleth.Functions.Compose">
<constructor-arg name="g">
- <bean class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.ClientInfoScopeLookupFunction" />
+ <bean class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.ClientInfoScopeLookupFunction"
+ p:defaultScope="#{'%{idp.oauth2.defaultAllowedScope:}'.trim()}" />
</constructor-arg>
<constructor-arg name="f">
<bean class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultOIDCMetadataContextLookupFunction" />
@@ -220,7 +221,8 @@
<bean id="shibboleth.oidc.DefaultAllowedAudienceStrategy" parent="shibboleth.Functions.Compose">
<constructor-arg name="g">
- <bean class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.ClientInfoAudienceLookupFunction" />
+ <bean class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.ClientInfoAudienceLookupFunction"
+ p:defaultAudience="#{'%{idp.oauth2.defaultAllowedAudience:}'.trim()}" />
</constructor-arg>
<constructor-arg name="f">
<bean class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultOIDCMetadataContextLookupFunction" />
diff --git a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
index 26523762..1ed13bce 100644
--- a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
+++ b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
@@ -104,6 +104,10 @@ idp.oidc.subject.salt = this_too_should_be_ch4ng3d
# Set false to preclude issuing unencrypted JWT access tokens without specific overrides
#idp.oauth2.encryptionOptional = true
+# Default scope/audience values if you allow unverified clients without metadata.
+#idp.oauth2.defaultAllowedScope =
+#idp.oauth2.defaultAllowedAudience =
+
# Regular expression matching OAuth login flows to enable.
# For most deployments, the default is sufficient to accomodate a variety of methods
#idp.oauth2.authn.flows = OAuth2Client
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list