[java-idp-plugin-oidc-rp] branch main updated: Update to support new JOSE Header credential resolver

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=a0ac3318e66ca43b6001d7a5bacd8729d5b35b11

The following commit(s) were added to refs/heads/main by this push:
     new a0ac331  Update to support new JOSE Header credential resolver
a0ac331 is described below

commit a0ac3318e66ca43b6001d7a5bacd8729d5b35b11
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Mon Jun 6 10:42:19 2022 +0100

    Update to support new JOSE Header credential resolver
---
 .../net/shibboleth/idp/service/relying-party/postconfig.xml  | 12 +++++++++---
 .../idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java        |  5 +++--
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index b565388..e22f5fc 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -95,7 +95,8 @@
         p:signatureTrustEngine-ref="ExplicitKeySignedJWTTrustEngine">
     </bean>
 
-    <bean id="defaultSignedJWTCredentialResolver"
+    <!-- A resolver for resolving trusted credentials to match against those used  -->
+    <bean id="defaultSignedJWTTrustedCredentialResolver"
         class="org.opensaml.security.credential.impl.ChainingCredentialResolver">
         <constructor-arg>
             <list>
@@ -107,12 +108,17 @@
             </list>
         </constructor-arg>
     </bean>
+    
+    <!-- A resolver for resolving Credentials out of the JOSE header of JWTs -->
+    <bean id="defaultSignedJWTJOSEHeaderCredentialResolver"
+        class="net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver"/>
 
     <bean id="ExplicitKeySignedJWTTrustEngine"
         class="net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine"
-        c:resolver-ref="defaultSignedJWTCredentialResolver" />
-
+        c:resolver-ref="defaultSignedJWTTrustedCredentialResolver"
+        c:JOSEObjectResolver-ref="defaultSignedJWTJOSEHeaderCredentialResolver" />
 
+        
 
 
 </beans>
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java
index 0b1a817..7a4ee64 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java
@@ -106,6 +106,7 @@ import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
 import net.shibboleth.oidc.security.credential.BasicExpiringJWKCredential;
 import net.shibboleth.oidc.security.credential.BasicJWKCredential;
 import net.shibboleth.oidc.security.credential.JWKCredential;
+import net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver;
 import net.shibboleth.oidc.security.credential.impl.JWKEncryptionCredentialContext;
 import net.shibboleth.oidc.security.impl.BasicJWTDecryptionConfiguration;
 import net.shibboleth.oidc.security.impl.BasicSignatureValidationConfiguration;
@@ -927,7 +928,7 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
         final BasicSignatureValidationConfiguration<SignedJWT> sigValidation = 
                 new BasicSignatureValidationConfiguration<>();
         sigValidation.setSignatureTrustEngine(new ExplicitKeySignedJWTTrustEngine(
-                new CriterionCredentialResolver()));
+                new CriterionCredentialResolver(), new BasicJOSEObjectCredentialResolver()));
         
         secConfig.setIdTokenJwtSignatureValidationConfig(sigValidation);   
         
@@ -1038,7 +1039,7 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
         final BasicSignatureValidationConfiguration<SignedJWT> sigValidation = 
                 new BasicSignatureValidationConfiguration<>();
         sigValidation.setSignatureTrustEngine(new ExplicitKeySignedJWTTrustEngine(
-                new CriterionCredentialResolver()));
+                new CriterionCredentialResolver(), new BasicJOSEObjectCredentialResolver()));
         
         secConfig.setIdTokenJwtSignatureValidationConfig(sigValidation);   
         

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.