[JIRA] (JOIDC-76) Facilitate custom response header settings (e.g. CORS)

[Henri Mikkonen (Jira)]

Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd ) *commented* on JOIDC-76 ( https://shibboleth.atlassian.net/browse/JOIDC-76?atlOrigin=eyJpIjoiOTNiMmIxYmZkMDc1NGYxMWEwYmQ2ZDNiNGQ1MGMzMmUiLCJwIjoiaiJ9 )

Re: Facilitate custom response header settings (e.g. CORS) ( https://shibboleth.atlassian.net/browse/JOIDC-76?atlOrigin=eyJpIjoiOTNiMmIxYmZkMDc1NGYxMWEwYmQ2ZDNiNGQ1MGMzMmUiLCJwIjoiaiJ9 )

It feels that the following approach could be a good candidate for enabling configurable custom headers for the OP’s flows:

* Register a new filter (say DynamicOidcResponseHeaderFilter), reminding the already existing DynamicResponseHeaderFilter (which is set up in the web.xml)

* The registration can be done dynamically via ServletContainerInitializer
* Mappings should probably only contain */profile/oidc/* * and */profile/oauth2/* *

* The new filter’s target bean could be e.g. shibboleth.oidc.ResponseHeaderFilter

* I think it makes sense not to use the already existing shibboleth.ResponseHeaderFilter, as the response header requirements might be different for the OP’s endpoints
* Also, as we didn’t support custom header settings before, the default should probably be not to set any custom headers

* The new target bean should be configurable via property, for instance by the following global bean definition

* 
   <alias name="%{idp.oidc.ResponseHeaderFilter:shibboleth.oidc.EmptyResponseHeaderFilter}"
       alias="shibboleth.oidc.ResponseHeaderFilter" />
   
   <bean id="shibboleth.oidc.EmptyResponseHeaderFilter"
       class="net.shibboleth.utilities.java.support.net.DynamicResponseHeaderFilter" />

I verified that the approach seems to work as expected in Jetty and Tomcat.

The CORS-support can be handled by https://shibboleth.atlassian.net/browse/IDP-1907.

( https://shibboleth.atlassian.net/browse/JOIDC-76#add-comment?atlOrigin=eyJpIjoiOTNiMmIxYmZkMDc1NGYxMWEwYmQ2ZDNiNGQ1MGMzMmUiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JOIDC-76#add-comment?atlOrigin=eyJpIjoiOTNiMmIxYmZkMDc1NGYxMWEwYmQ2ZDNiNGQ1MGMzMmUiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100194- sha1:533b55a )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220302/37623eb5/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-709e3581-27d2-4e96-bc74-fd0d4deae755
Type: image/png
Size: 341 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220302/37623eb5/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-b19e0f4f-a8eb-428d-a999-d86f902e5fc4
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220302/37623eb5/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-d4c1055c-5bef-4695-9447-7f46ccfc5e3b
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220302/37623eb5/attachment-0005.png>