[java-idp-plugin-oidc-rp] branch main updated: Wire up UserInfo signature validation and decryption config beans

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=d1e525940ee30b74635e68affb21327a26c10193

The following commit(s) were added to refs/heads/main by this push:
     new d1e5259  Wire up UserInfo signature validation and decryption config beans
d1e5259 is described below

commit d1e525940ee30b74635e68affb21327a26c10193
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Jun 8 10:13:45 2022 +0100

    Wire up UserInfo signature validation and decryption config beans
---
 .../idp/service/relying-party/postconfig.xml           | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index e22f5fc..01b4531 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -43,11 +43,20 @@
         class="net.shibboleth.oidc.profile.config.OIDCSecurityConfiguration">
         <property name="idTokenJwtDecryptionConfig">
             <ref
-                bean="#{'%{dp.authn.oidc.rp.idtoken.decrypt.config:shibboleth.authn.oidc.rp.DefaultDecryptionConfiguration}'.trim()}" />
+                bean="#{'%{dp.authn.oidc.rp.idtoken.decrypt.config:shibboleth.authn.oidc.rp.DefaultJWTDecryptionConfiguration}'.trim()}" />
         </property>
         <property name="idTokenJwtSignatureValidationConfig">
             <ref
-                bean="#{'%{dp.authn.oidc.rp.idtoken.valid.config:shibboleth.authn.oidc.rp.IDTokenJwtSignatureValidationConfiguration}'.trim()}" />
+                bean="#{'%{dp.authn.oidc.rp.idtoken.valid.config:shibboleth.authn.oidc.rp.DefaultJWTSignatureValidationConfiguration}'.trim()}" />
+        </property>
+        <!-- User info config is actually the same by default as id_token, not sure we need seperation, although could be overriden -->
+        <property name="userInfoJwtDecryptionConfig">
+            <ref
+                bean="#{'%{dp.authn.oidc.rp.userinfotoken.decrypt.config:shibboleth.authn.oidc.rp.DefaultJWTDecryptionConfiguration}'.trim()}" />
+        </property>
+        <property name="userInfoTokenJwtSignatureValidationConfig">
+            <ref
+                bean="#{'%{dp.authn.oidc.rp.userinfotoken.valid.config:shibboleth.authn.oidc.rp.DefaultJWTSignatureValidationConfiguration}'.trim()}" />
         </property>
     </bean>
 
@@ -60,7 +69,7 @@
         p:encMethod="%{idp.authn.oidc.rp.client.clientSecret.encMethods:A256GCM}"
         p:alg="dir" />
 
-    <bean id="shibboleth.authn.oidc.rp.DefaultDecryptionConfiguration"
+    <bean id="shibboleth.authn.oidc.rp.DefaultJWTDecryptionConfiguration"
         class="net.shibboleth.oidc.security.impl.BasicJWTDecryptionConfiguration"
         p:KEKCredentialResolver-ref="defaultOIDCRPKeyEncryptionCredentialResolver"
         p:contentEncryptionKeyCredentialResolver-ref="defaultOIDCRPContentEncryptionKeyCredentialResolver"/>
@@ -90,10 +99,11 @@
     <!-- Configuration for supported algorithms for token endpoint authentication JWT signature validation. -->
     <!-- TODO This was a parent bean, but as that was not compatible with the new trust engine stuff, I moved to it's own 
         class for now -->
-    <bean id="shibboleth.authn.oidc.rp.IDTokenJwtSignatureValidationConfiguration"
+    <bean id="shibboleth.authn.oidc.rp.DefaultJWTSignatureValidationConfiguration"
         class="net.shibboleth.oidc.security.impl.BasicSignatureValidationConfiguration"
         p:signatureTrustEngine-ref="ExplicitKeySignedJWTTrustEngine">
     </bean>
+    
 
     <!-- A resolver for resolving trusted credentials to match against those used  -->
     <bean id="defaultSignedJWTTrustedCredentialResolver"

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.