[java-idp-oidc] branch main updated: JOIDC-21 - Use token authentication for OIDC dynamic client registration

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=ca29366ba4ae38745d25ade920899a760fe1dc30

The following commit(s) were added to refs/heads/main by this push:
     new ca29366b JOIDC-21 - Use token authentication for OIDC dynamic client registration
ca29366b is described below

commit ca29366ba4ae38745d25ade920899a760fe1dc30
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Mar 4 14:11:43 2022 +0200

    JOIDC-21 - Use token authentication for OIDC dynamic client registration
    
    https://shibboleth.atlassian.net/browse/JOIDC-21
    
    For the token issuance flow: use the metadataPolicyLocation request parameter as
    the policy identifier. Also explicitly set expiration time to the past and cache
    duration to zero in order to disable caching.
---
 .../issue-registration-access-token-beans.xml               | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/oidc/issue-registration-access-token/issue-registration-access-token-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/oidc/issue-registration-access-token/issue-registration-access-token-beans.xml
index ff0c5e0a..ad156e21 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/oidc/issue-registration-access-token/issue-registration-access-token-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/oidc/issue-registration-access-token/issue-registration-access-token-beans.xml
@@ -59,7 +59,7 @@
         <constructor-arg>
             <bean parent="shibboleth.oidc.admin.DynamicCacheBuilder">
                 <constructor-arg>
-                    <bean p:cacheId="AdminMetadataPolicyeCache" parent="shibboleth.oidc.admin.BaseDynamicCacheBuilderSpec" />
+                    <bean p:cacheId="AdminMetadataPolicyCache" parent="shibboleth.oidc.admin.BaseDynamicCacheBuilderSpec" />
                 </constructor-arg>
             </bean>
         </constructor-arg>
@@ -73,13 +73,15 @@
         c:valueClass="net.shibboleth.oidc.metadata.policy.MetadataPolicy"/>
 
     <bean id="shibboleth.oidc.admin.CriteriaToIdentifierStrategy"
-       parent="shibboleth.Functions.Constant" c:target="AdminFlowProvidedMetadataPolicy" />
+       parent="shibboleth.Functions.Expression" p:customObject-ref="shibboleth.HttpServletRequest"
+       c:expression="#custom.getParameter(T(net.shibboleth.idp.plugin.oidc.op.cli.IssueRegistrationAccessTokenArguments).URL_PARAM_METADATA_POLICY_LOCATION)" />
 
     <bean id="shibboleth.oidc.admin.ExpirationTimeStrategy" parent="shibboleth.Functions.Constant"
-        c:target="#{T(java.time.Instant).now()}" />
+        c:target="#{T(java.time.Instant).ofEpochSecond(1)}" />
 
     <bean id="shibboleth.oidc.admin.MetadataPolicyIdentifierExtractionStrategy"
-       parent="shibboleth.Functions.Constant" c:target="AdminFlowProvidedMetadataPolicy" />
+       parent="shibboleth.Functions.Expression" p:customObject-ref="shibboleth.HttpServletRequest"
+       c:expression="#custom.getParameter(T(net.shibboleth.idp.plugin.oidc.op.cli.IssueRegistrationAccessTokenArguments).URL_PARAM_METADATA_POLICY_LOCATION)" />
         
     <bean id="dynamicCacheFactory" class="net.shibboleth.oidc.metadata.cache.impl.DynamicMetadataCacheBuilder$Builder"/>
     
@@ -91,7 +93,8 @@
         p:fetchStrategy-ref="shibboleth.oidc.admin.MetadataPolicyFetchingStrategy" 
         p:criteriaToIdentifierStrategy-ref="shibboleth.oidc.admin.CriteriaToIdentifierStrategy" 
         p:metadataExpirationTimeStrategy-ref="shibboleth.oidc.admin.ExpirationTimeStrategy" 
-        p:identifierExtractionStrategy-ref="shibboleth.oidc.admin.MetadataPolicyIdentifierExtractionStrategy" 
+        p:identifierExtractionStrategy-ref="shibboleth.oidc.admin.MetadataPolicyIdentifierExtractionStrategy"
+        p:minCacheDuration="0"
        />
        
     <bean id="shibboleth.oidc.admin.MetadataPolicyFetchingStrategy"

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.