[java-idp-oidc] branch main updated: Adjust flow to isolate steps for non-client_credential grants.
Scott Cantor
cantor.2 at osu.edu
Fri Jan 7 01:08:42 UTC 2022
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=5e0e5b30b06010e7b5e431ac2110fe270259e22a
The following commit(s) were added to refs/heads/main by this push:
new 5e0e5b30 Adjust flow to isolate steps for non-client_credential grants.
5e0e5b30 is described below
commit 5e0e5b30b06010e7b5e431ac2110fe270259e22a
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Jan 6 20:08:39 2022 -0500
Adjust flow to isolate steps for non-client_credential grants.
---
.../plugin/oidc/op/profile/impl/ValidateGrant.java | 6 +--
.../flows/oidc/abstract/oidc-abstract-beans.xml | 2 +-
.../idp/flows/oidc/authorize/authorize-beans.xml | 8 ++--
.../idp/flows/oidc/token/token-beans.xml | 53 +++++++++++-----------
.../shibboleth/idp/flows/oidc/token/token-flow.xml | 39 ++++++++++++----
5 files changed, 66 insertions(+), 42 deletions(-)
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateGrant.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateGrant.java
index a2875afd..29fe3931 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateGrant.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateGrant.java
@@ -223,13 +223,13 @@ public class ValidateGrant extends AbstractOIDCTokenResponseAction {
ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_GRANT);
return;
}
- if (tokenClaimsSet.isExpired()) {
- log.warn("{} token exp is in the past {}", getLogPrefix(), tokenClaimsSet.getExp());
+ if (!tokenClaimsSet.isTimeValid()) {
+ log.warn("{} Token is expired or not net valid", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_GRANT);
return;
}
if (!tokenClaimsSet.getClientID().getValue().equals(rpCtx.getRelyingPartyId())) {
- log.warn("{} token issued for client {}, expected value was {}", getLogPrefix(),
+ log.warn("{} Token issued to client {}, invalid for {}", getLogPrefix(),
tokenClaimsSet.getClientID().getValue(), rpCtx.getRelyingPartyId());
ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_GRANT);
return;
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml
index 92794552..7101c04a 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml
@@ -22,7 +22,7 @@
p:loggingId-ref="shibboleth.oidc.loggingId"
p:browserProfile-ref="shibboleth.oidc.browserProfile" />
- <bean id="shibboleth.oidc.IDTokenSignatureSigningParametersResolver"
+ <bean id="shibboleth.oidc.TokenSignatureSigningParametersResolver"
class="net.shibboleth.idp.plugin.oidc.op.security.impl.OIDCClientInformationSignatureSigningParametersResolver" />
<bean id="shibboleth.RevocationCache" class="net.shibboleth.idp.plugin.oidc.op.storage.RevocationCache"
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
index a7fe956a..0c55f4a1 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
@@ -62,7 +62,8 @@
<bean id="shibboleth.oidc.EncryptionParametersResolverForRequestObjectDecryption"
class="net.shibboleth.idp.plugin.oidc.op.security.impl.OIDCClientInformationEncryptionParametersResolver"
- p:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache" p:keyFetchInterval="%{idp.oidc.jwksuri.fetchInterval:PT30M}"
+ p:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache"
+ p:keyFetchInterval="%{idp.oidc.jwksuri.fetchInterval:PT30M}"
p:parameterType="#{T(net.shibboleth.idp.plugin.oidc.op.security.impl.OIDCClientInformationEncryptionParametersResolver.ParameterType).REQUEST_OBJECT_DECRYPTION}" />
<bean id="shibboleth.oidc.DecryptionConfigurationLookup"
@@ -91,7 +92,8 @@
<bean id="shibboleth.oidc.RequestObjectSignatureValidationParametersResolver"
class="net.shibboleth.idp.plugin.oidc.op.security.impl.OIDCClientInformationSignatureValidationParametersResolver"
- p:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache" p:keyFetchInterval="%{idp.oidc.jwksuri.fetchInterval:PT30M}"
+ p:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache"
+ p:keyFetchInterval="%{idp.oidc.jwksuri.fetchInterval:PT30M}"
p:parameterType="#{T(net.shibboleth.idp.plugin.oidc.op.security.impl.OIDCClientInformationSignatureValidationParametersResolver.ParameterType).REQUEST_OBJECT_VALIDATION}" />
<bean id="SetRequestObjectToResponseContext"
@@ -171,7 +173,7 @@
<bean id="PopulateIDTokenSignatureSigningParameters"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.PopulateOIDCSignatureSigningParameters " scope="prototype"
p:configurationLookupStrategy-ref="shibboleth.SignatureSigningConfigurationLookup"
- p:signatureSigningParametersResolver-ref="shibboleth.oidc.IDTokenSignatureSigningParametersResolver">
+ p:signatureSigningParametersResolver-ref="shibboleth.oidc.TokenSignatureSigningParametersResolver">
<property name="activationCondition">
<ref bean="IDTokenRequested" />
</property>
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
index 1609014c..15f446c9 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
@@ -21,8 +21,9 @@
</bean>
<bean id="shibboleth.ClientIDLookupStrategy"
- class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestClientIDLookupFunction"
- scope="prototype" />
+ class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestClientIDLookupFunction" />
+
+ <bean id="ResolveAttributesPredicate" class="net.shibboleth.oidc.profile.config.logic.ResolveAttributesPredicate" />
<bean id="InitializeOutboundMessageContext"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.InitializeOutboundTokenResponseMessageContext"
@@ -49,8 +50,7 @@
class="net.shibboleth.idp.plugin.oidc.op.messaging.context.logic.RequestedGrantTypesCondition"
p:grantTypes="T(com.nimbusds.oauth2.sdk.GrantType).AUTHORIZATION_CODE" />
- <bean id="ValidatePKCE" class="net.shibboleth.idp.plugin.oidc.op.profile.impl.ValidatePKCE" scope="prototype"
- p:activationCondition-ref="NotClientCredentialsGrantCondition" />
+ <bean id="ValidatePKCE" class="net.shibboleth.idp.plugin.oidc.op.profile.impl.ValidatePKCE" scope="prototype" />
<bean id="ValidateRedirectURI" class="net.shibboleth.idp.plugin.oidc.op.profile.impl.ValidateRedirectURI"
scope="prototype"
@@ -59,12 +59,10 @@
p:validRedirectURIsLookupStrategy-ref="shibboleth.TokenRequestValidRequestUrisLookupStrategy" />
<bean id="shibboleth.TokenRequestRedirectURILookupStrategy"
- class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestRedirectURILookupFunction"
- scope="prototype" />
+ class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestRedirectURILookupFunction" />
<bean id="shibboleth.TokenRequestValidRequestUrisLookupStrategy"
- class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestValidRequestURIsLookupFunction"
- scope="prototype" />
+ class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestValidRequestURIsLookupFunction" />
<bean id="SetRequestedClaimsToResponseContext"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.SetRequestedClaimsToResponseContext" scope="prototype"
@@ -72,10 +70,9 @@
p:transcoderRegistry-ref="shibboleth.AttributeRegistryService" />
<bean id="shibboleth.TokenRequestRequestedClaimsLookupFunction"
- class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestRequestedClaimsLookupFunction"
- scope="prototype" />
+ class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestRequestedClaimsLookupFunction" />
- <bean id="SetAuthenticationContextClassReferenceToResponseContext"
+ <bean id="SetAuthenticationContextClassReferenceFromAuthzCodeToResponseContext"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.SetAuthenticationContextClassReferenceFromAuthzCodeToResponseContext"
scope="prototype" />
@@ -84,8 +81,7 @@
p:authTimeLookupStrategy-ref="shibboleth.TokenRequestAuthTimeLookupFunction" />
<bean id="shibboleth.TokenRequestAuthTimeLookupFunction"
- class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestAuthTimeLookupFunction"
- scope="prototype" />
+ class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestAuthTimeLookupFunction" />
<bean id="SetTokenDeliveryAttributesFromTokenToResponseContext"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.SetTokenDeliveryAttributesFromTokenToResponseContext"
@@ -94,13 +90,24 @@
<bean id="SetConsentToResponseContext"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.SetConsentFromTokenToResponseContext" scope="prototype" />
+ <bean id="InitializeSubjectContext"
+ class="net.shibboleth.idp.plugin.oidc.op.profile.impl.InitializeSubjectContext" scope="prototype" />
+
+ <bean id="SetSubjectToResponseContext"
+ class="net.shibboleth.idp.plugin.oidc.op.profile.impl.SetSubjectToResponseContext" scope="prototype" />
+
<bean id="ValidateScope" class="net.shibboleth.idp.plugin.oidc.op.profile.impl.ValidateScope" scope="prototype"
p:requestedScopesLookupStrategy-ref="shibboleth.TokenRequestScopeLookupStrategy" />
- <bean id="PopulateIDTokenSignatureSigningParameters"
+ <!--
+ TODO: May need to eventually conditionalize this and the encryption action following.
+ With opaque access tokens, this wouldn't be used for the client_credentials grant, but
+ with JWT access tokens it will be used for ID and access tokens. For now leaving enabled.
+ -->
+ <bean id="PopulateTokenSignatureSigningParameters"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.PopulateOIDCSignatureSigningParameters " scope="prototype"
p:configurationLookupStrategy-ref="shibboleth.SignatureSigningConfigurationLookup"
- p:signatureSigningParametersResolver-ref="shibboleth.oidc.IDTokenSignatureSigningParametersResolver">
+ p:signatureSigningParametersResolver-ref="shibboleth.oidc.TokenSignatureSigningParametersResolver">
<property name="securityParametersContextLookupStrategy">
<bean parent="shibboleth.Functions.Compose"
c:g-ref="shibboleth.ChildLookupOrCreate.SecurityParameters"
@@ -113,18 +120,18 @@
</property>
</bean>
- <bean id="PopulateIDTokenEncryptionParameters"
+ <bean id="PopulateTokenEncryptionParameters"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.PopulateOIDCEncryptionParameters" scope="prototype"
p:configurationLookupStrategy-ref="shibboleth.EncryptionConfigurationLookup"
p:encryptionParametersResolver-ref="shibboleth.oidc.EncryptionParametersResolver" />
<bean id="shibboleth.oidc.EncryptionParametersResolver"
class="net.shibboleth.idp.plugin.oidc.op.security.impl.OIDCClientInformationEncryptionParametersResolver"
- p:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache" p:keyFetchInterval="%{idp.oidc.jwksuri.fetchInterval:PT30M}" />
+ p:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache"
+ p:keyFetchInterval="%{idp.oidc.jwksuri.fetchInterval:PT30M}" />
<bean id="shibboleth.TokenRequestScopeLookupStrategy"
- class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestScopeLookupFunction"
- scope="prototype" />
+ class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestScopeLookupFunction" />
<bean id="SetAccessTokenToResponseContext"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.SetAccessTokenToResponseContext" scope="prototype"
@@ -134,15 +141,9 @@
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.SetRefreshTokenToResponseContext" scope="prototype"
c:sealer-ref="#{'%{idp.oidc.tokenSealer:shibboleth.oidc.TokenSealer}'.trim()}" />
- <bean id="InitializeSubjectContext" class="net.shibboleth.idp.plugin.oidc.op.profile.impl.InitializeSubjectContext"
+ <bean id="AddIDTokenShell" class="net.shibboleth.idp.plugin.oidc.op.profile.impl.AddIDTokenShell"
scope="prototype" />
- <bean id="SetSubjectToResponseContext"
- class="net.shibboleth.idp.plugin.oidc.op.profile.impl.SetSubjectToResponseContext" scope="prototype" />
-
- <bean id="AddIDTokenShell" class="net.shibboleth.idp.plugin.oidc.op.profile.impl.AddIDTokenShell" scope="prototype">
- </bean>
-
<bean id="AddAttributeClaimsToIDToken"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.AddAttributesToClaimsSet" scope="prototype"
p:targetIDToken="true"
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-flow.xml
index 34ee4e0a..e8888e9e 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-flow.xml
@@ -32,35 +32,56 @@
<action-state id="ResumeAfterAuthentication">
<evaluate expression="ValidateGrantType" />
+ <evaluate expression="'proceed'" />
+ <transition on="proceed" to="BranchOnGrantType" />
+ </action-state>
+
+ <decision-state id="BranchOnGrantType">
+ <if test="NotClientCredentialsGrantCondition.test(opensamlProfileRequestContext)"
+ then="TraditionalGrantProcessing"
+ else="CommonProcessing" />
+ </decision-state>
+
+ <!-- These steps apply to grants that rely on the authorization endpoint to "prime" the token request. -->
+ <action-state id="TraditionalGrantProcessing">
<evaluate expression="ValidateGrant" />
<evaluate expression="ValidatePKCE" />
<evaluate expression="ValidateRedirectURI" />
<evaluate expression="SetRequestedClaimsToResponseContext" />
- <evaluate expression="SetAuthenticationContextClassReferenceToResponseContext" />
+ <evaluate expression="SetAuthenticationContextClassReferenceFromAuthzCodeToResponseContext" />
<evaluate expression="SetAuthenticationTimeToResponseContext" />
<evaluate expression="SetTokenDeliveryAttributesFromTokenToResponseContext" />
<evaluate expression="SetConsentToResponseContext" />
- <evaluate expression="ValidateScope" />
- <evaluate expression="PopulateIDTokenSignatureSigningParameters" />
- <evaluate expression="PopulateIDTokenEncryptionParameters" />
+ <evaluate expression="InitializeSubjectContext" />
+ <evaluate expression="SetSubjectToResponseContext" />
<evaluate expression="'proceed'" />
- <transition on="proceed" to="PostInitialSetup" />
+ <transition on="proceed" to="CommonGrantProcessing" />
</action-state>
- <action-state id="PostInitialSetup">
- <evaluate expression="InitializeSubjectContext" />
+ <!-- These steps are common to all grant types. -->
+ <action-state id="CommonGrantProcessing">
+ <evaluate expression="ValidateScope" />
+ <evaluate expression="PopulateTokenSignatureSigningParameters" />
+ <evaluate expression="PopulateTokenEncryptionParameters" />
<evaluate expression="'proceed'" />
- <transition on="proceed" to="AttributeResolution" />
+ <transition on="proceed" to="CheckAttributeResolution" />
</action-state>
+ <decision-state id="CheckAttributeResolution">
+ <if test="ResolveAttributesPredicate.test(opensamlProfileRequestContext)"
+ then="AttributeResolution"
+ else="DoConsentLookup" />
+ </decision-state>
+
<action-state id="AttributeResolution">
- <evaluate expression="SetSubjectToResponseContext" />
<evaluate expression="ResolveAttributes" />
<evaluate expression="FilterAttributes" />
<evaluate expression="'proceed'" />
<transition on="proceed" to="DoConsentLookup" />
</action-state>
+ <!-- Consent check is not applicable to some grant types but does no harm. -->
+
<action-state id="BuildResponse">
<evaluate expression="SetAccessTokenToResponseContext" />
<evaluate expression="SetRefreshTokenToResponseContext" />
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list