[java-idp-oidc] branch main updated: JOIDC-92 - Support for refresh token rotation

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=cf809291ddfaeeec96c5e765835834ef3d0e85f5

The following commit(s) were added to refs/heads/main by this push:
     new cf809291 JOIDC-92 - Support for refresh token rotation
cf809291 is described below

commit cf809291ddfaeeec96c5e765835834ef3d0e85f5
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Jun 17 14:53:45 2022 +0300

    JOIDC-92 - Support for refresh token rotation
    
    https://shibboleth.atlassian.net/browse/JOIDC-92
    
    - Configuration property 'idp.oauth2.enforceRefreshTokenRotation'
    - Wired MDDriven configuration
---
 .../net/shibboleth/idp/service/relying-party/postconfig.xml   | 11 ++++++++++-
 .../net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties    |  3 +++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index 21598eaa..c0ffe0ab 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -63,7 +63,8 @@
 
     <bean id="OAUTH2.Token" parent="AbstractOIDCSSOProfile" lazy-init="true"
         class="net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenConfiguration"
-        p:grantTypes="%{idp.oauth2.grantTypes:authorization_code,refresh_token}" />
+        p:grantTypes="%{idp.oauth2.grantTypes:authorization_code,refresh_token}"
+        p:enforceRefreshTokenRotation="%{idp.oauth2.enforceRefreshTokenRotation:false}" />
     
     <bean id="OAUTH2.TokenAudience" parent="AbstractOIDCProfile" lazy-init="true"
         class="net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenAudienceConfiguration"
@@ -408,6 +409,14 @@
             <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="refreshTokenClaimsSetManipulationStrategy"
                 p:propertyType="#{T(java.util.function.Function)}" />
         </property>
+        <property name="enforceRefreshTokenRotationPredicate">
+            <bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
+                <constructor-arg>
+                    <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="enforceRefreshTokenRotation" />
+                </constructor-arg>
+                <constructor-arg value="%{idp.oauth2.enforceRefreshTokenRotation:false}" />
+            </bean>
+        </property>
     </bean>
     
     <bean id="OAUTH2.TokenAudience.MDDriven" parent="AbstractMDDrivenOIDCProfile" lazy-init="true"
diff --git a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
index 97141932..49699e11 100644
--- a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
+++ b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
@@ -133,3 +133,6 @@ idp.oidc.subject.salt = this_too_should_be_ch4ng3d
 # Regular expression matching OAuth login flows to enable.
 # For most deployments, the default is sufficient to accomodate a variety of methods
 #idp.oauth2.authn.flows = OAuth2Client
+
+# Set true to enforce refresh token rotation (defaults to false)
+#idp.oauth2.enforceRefreshTokenRotation = true
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.