[java-idp-oidc] branch main updated: Additional login flow cleanup.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=57cbb0de352030c68be1cdb0f4ae7b98c1df605f

The following commit(s) were added to refs/heads/main by this push:
     new 57cbb0de Additional login flow cleanup.
57cbb0de is described below

commit 57cbb0de352030c68be1cdb0f4ae7b98c1df605f
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Feb 22 16:46:27 2022 -0500

    Additional login flow cleanup.
---
 .../.settings/org.testng.eclipse.maven.prefs           |  2 ++
 .../META-INF/net.shibboleth.idp/postconfig.xml         | 18 +++++++++---------
 .../flows/authn/OAuth2Client/OAuth2Client-beans.xml    | 14 ++++++++------
 3 files changed, 19 insertions(+), 15 deletions(-)

diff --git a/idp-oidc-extension-impl/.settings/org.testng.eclipse.maven.prefs b/idp-oidc-extension-impl/.settings/org.testng.eclipse.maven.prefs
new file mode 100644
index 00000000..3a6c4f35
--- /dev/null
+++ b/idp-oidc-extension-impl/.settings/org.testng.eclipse.maven.prefs
@@ -0,0 +1,2 @@
+eclipse.preferences.version=1
+userprojectsettings=false
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 36b87bd2..e3e2067b 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -32,15 +32,15 @@
     <!-- OAuth2 login flow -->
     <bean p:id="authn/OAuth2Client" parent="shibboleth.AuthenticationFlow"
             p:order="%{idp.authn.OAuth2Client.order:1000}"
-            p:nonBrowserSupported="%{idp.authn.OAuth2Client.nonBrowserSupported:true}"
-            p:passiveAuthenticationSupported="%{idp.authn.OAuth2Client.passiveAuthenticationSupported:true}"
-            p:forcedAuthenticationSupported="%{idp.authn.OAuth2Client.forcedAuthenticationSupported:true}"
-            p:proxyRestrictionsEnforced="%{idp.authn.OAuth2Client.proxyRestrictionsEnforced:%{idp.authn.enforceProxyRestrictions:true}}"
-            p:proxyScopingEnforced="%{idp.authn.OAuth2Client.proxyScopingEnforced:false}"
-            p:discoveryRequired="%{idp.authn.OAuth2Client.discoveryRequired:false}"
-            p:lifetime="%{idp.authn.OAuth2Client.lifetime:%{idp.authn.defaultLifetime:PT60S}}"
-            p:inactivityTimeout="%{idp.authn.OAuth2Client.inactivityTimeout:%{idp.authn.defaultTimeout:PT60S}}"
-            p:reuseCondition-ref="#{'%{idp.authn.OAuth2Client.reuseCondition:shibboleth.Conditions.FALSE}'.trim()}"
+            p:nonBrowserSupported="true"
+            p:passiveAuthenticationSupported="true"
+            p:forcedAuthenticationSupported="true"
+            p:proxyRestrictionsEnforced="true"
+            p:proxyScopingEnforced="false"
+            p:discoveryRequired="false"
+            p:lifetime="PT60S"
+            p:inactivityTimeout="PT60S"
+            p:reuseCondition-ref="shibboleth.Conditions.FALSE"
             p:activationCondition-ref="#{'%{idp.authn.OAuth2Client.activationCondition:shibboleth.Conditions.TRUE}'.trim()}"
             p:subjectDecorator="#{getObject('%{idp.authn.OAuth2Client.subjectDecorator:}'.trim())}">
         <property name="supportedPrincipalsByString">
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-beans.xml
index 3b1dc66e..8510baa3 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-beans.xml
@@ -46,8 +46,7 @@
         p:addDefaultPrincipals="%{idp.authn.OAuth2Client.addDefaultPrincipals:true}"
         p:supportedPrincipals="#{getObject('shibboleth.authn.OAuth2Client.PrincipalOverride')}"
         p:classifiedMessages="#{getObject('shibboleth.authn.OAuth2Client.ClassifiedMessageMap')}"
-        p:resultCachingPredicate="#{getObject('shibboleth.authn.OAuth2Client.resultCachingPredicate')}"
-        p:cleanupHook-ref="DefaultCleanupHook"
+        p:cleanupHook="#{T(java.lang.Boolean).valueOf('%{idp.authn.OAuth2Client.removeAfterValidation:true}') ? getObject('DefaultCleanupHook') : null}"
         p:lockoutManager="#{getObject('shibboleth.authn.OAuth2Client.AccountLockoutManager')}" />
     
     <bean id="PopulateSubjectCanonicalizationContext"
@@ -63,22 +62,25 @@
         
     <!-- Validator parent beans -->
 
-    <bean id="shibboleth.OIDCClientInfoValidator"
+    <bean id="shibboleth.CredentialValidator" abstract="true"
+        p:savePasswordToCredentialSet="%{idp.authn.OAuth2Client.retainAsPrivateCredential:false}" />
+
+    <bean id="shibboleth.OIDCClientInfoValidator" parent="shibboleth.CredentialValidator"
         class="net.shibboleth.idp.plugin.oidc.op.authn.impl.OIDCClientInfoCredentialValidator"
         p:id="oauth2-clientinfo" />
         
     <bean id="shibboleth.JWTValidator" class="net.shibboleth.idp.plugin.oidc.op.authn.impl.JWTCredentialValidator"
         p:id="oauth2-jwt" />
     
-    <bean id="shibboleth.JAASValidator"
+    <bean id="shibboleth.JAASValidator" parent="shibboleth.CredentialValidator"
         class="net.shibboleth.idp.authn.impl.JAASCredentialValidator" abstract="true"
         p:id="oauth2-jaas" />
 
-    <bean id="shibboleth.KerberosValidator"
+    <bean id="shibboleth.KerberosValidator" parent="shibboleth.CredentialValidator"
         class="net.shibboleth.idp.authn.impl.KerberosCredentialValidator" abstract="true"
         p:id="oauth2-krb5" />
 
-    <bean id="shibboleth.LDAPValidator" lazy-init="true"
+    <bean id="shibboleth.LDAPValidator" parent="shibboleth.CredentialValidator" lazy-init="true"
         class="net.shibboleth.idp.authn.impl.LDAPCredentialValidator"
         p:id="oauth2-ldap"
         p:authenticator-ref="shibboleth.authn.OAuth2Client.LDAP.authenticator" />

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.