[java-idp-oidc] branch main updated: JOIDC-21 - Use token authentication for OIDC dynamic client registration
Scott Cantor
cantor.2 at osu.edu
Thu Mar 10 18:28:59 UTC 2022
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=4e9bade382148440233cd58c53ea10133682ddf4
The following commit(s) were added to refs/heads/main by this push:
new 4e9bade3 JOIDC-21 - Use token authentication for OIDC dynamic client registration
4e9bade3 is described below
commit 4e9bade382148440233cd58c53ea10133682ddf4
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Mar 10 13:28:57 2022 -0500
JOIDC-21 - Use token authentication for OIDC dynamic client registration
https://shibboleth.atlassian.net/browse/JOIDC-21
Add dedicated flow descriptor class for additional settings.
Refactor issuer handling around that descriptor.
---
idp-oidc-extension-api/pom.xml | 5 ++
.../IssueRegistrationTokenFlowDescriptor.java | 79 ++++++++++++++++++++++
.../idp/plugin/oidc/op/admin/package-info.java | 21 ++++++
.../profile/impl/IssueRegistrationAccessToken.java | 18 +++--
.../META-INF/net.shibboleth.idp/postconfig.xml | 10 ++-
.../issue-registration-access-token-beans.xml | 6 +-
.../idp/service/relying-party/postconfig.xml | 28 ++++----
.../idp/plugin/oidc/op/conf/oidc.properties | 12 ++--
8 files changed, 142 insertions(+), 37 deletions(-)
diff --git a/idp-oidc-extension-api/pom.xml b/idp-oidc-extension-api/pom.xml
index 59be2ebd..06da12a3 100644
--- a/idp-oidc-extension-api/pom.xml
+++ b/idp-oidc-extension-api/pom.xml
@@ -38,6 +38,11 @@
<artifactId>idp-profile-api</artifactId>
<scope>provided</scope>
</dependency>
+ <dependency>
+ <groupId>net.shibboleth.idp</groupId>
+ <artifactId>idp-admin-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
<dependency>
<groupId>net.shibboleth.idp</groupId>
<artifactId>idp-authn-api</artifactId>
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/admin/IssueRegistrationTokenFlowDescriptor.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/admin/IssueRegistrationTokenFlowDescriptor.java
new file mode 100644
index 00000000..0bd0fe77
--- /dev/null
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/admin/IssueRegistrationTokenFlowDescriptor.java
@@ -0,0 +1,79 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.oidc.op.admin;
+
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.idp.admin.BasicAdministrativeFlowDescriptor;
+import net.shibboleth.idp.profile.config.OverriddenIssuerProfileConfiguration;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.logic.FunctionSupport;
+
+/**
+ * Descriptor for flow that issues access tokens for client registration.
+ *
+ * @since 3.1.0
+ */
+public class IssueRegistrationTokenFlowDescriptor extends BasicAdministrativeFlowDescriptor
+ implements OverriddenIssuerProfileConfiguration {
+
+ /** Profile ID. */
+ @Nonnull @NotEmpty public static final String PROFILE_ID =
+ "http://shibboleth.net/ns/profiles/oidc/issue-registration-access-token";
+
+ /** Lookup function to override issuer value. */
+ @Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
+
+ /** Constructor. */
+ public IssueRegistrationTokenFlowDescriptor() {
+ super(PROFILE_ID);
+ setNonBrowserSupported(true);
+
+ issuerLookupStrategy = FunctionSupport.constant(null);
+ }
+
+ /** {@inheritDoc} */
+ @Nullable @NotEmpty public String getIssuer(@Nullable final ProfileRequestContext profileRequestContext) {
+ return issuerLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Set overridden issuer value.
+ *
+ * @param issuer issuer value
+ */
+ public void setIssuer(@Nullable @NotEmpty final String issuer) {
+ issuerLookupStrategy = FunctionSupport.constant(issuer);
+ }
+
+ /**
+ * Sets lookup strategy for overridden issuer value.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setIssuerLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
+ issuerLookupStrategy = Constraint.isNotNull(strategy, "Issuer lookup strategy cannot be null");
+ }
+
+}
\ No newline at end of file
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/admin/package-info.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/admin/package-info.java
new file mode 100644
index 00000000..2e87b368
--- /dev/null
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/admin/package-info.java
@@ -0,0 +1,21 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Classes related to OP administrative features.
+ */
+package net.shibboleth.idp.plugin.oidc.op.admin;
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/IssueRegistrationAccessToken.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/IssueRegistrationAccessToken.java
index 473b39c7..deb8e141 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/IssueRegistrationAccessToken.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/IssueRegistrationAccessToken.java
@@ -47,6 +47,7 @@ import net.shibboleth.idp.plugin.oidc.op.profile.logic.DefaultRegistrationTokenR
import net.shibboleth.idp.plugin.oidc.op.token.support.RegistrationClaimsSet;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.idp.profile.context.SpringRequestContext;
+import net.shibboleth.idp.profile.context.navigate.ResponderIdLookupFunction;
import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
@@ -118,6 +119,7 @@ public class IssueRegistrationAccessToken extends AbstractProfileAction {
*/
public IssueRegistrationAccessToken() {
idGeneratorLookupStrategy = FunctionSupport.constant(new SecureRandomIdentifierGenerationStrategy());
+ issuerLookupStrategy = new ResponderIdLookupFunction();
tokenLifetimeLookupStrategy = new DefaultRegistrationTokenLifetimeLookupFunction();
relyingPartyIdLookupStrategy = new DefaultRegistrationTokenRelyingPartyIdLookupFunction();
onetimeUseLookupStrategy = new DefaultRegistrationTokenOnetimeUseLookupFunction();
@@ -222,20 +224,16 @@ public class IssueRegistrationAccessToken extends AbstractProfileAction {
super.doInitialize();
if (dataSealer == null) {
- throw new ComponentInitializationException("Data sealer cannot be null");
+ throw new ComponentInitializationException("DataSealer cannot be null");
}
if (objectMapper == null) {
- throw new ComponentInitializationException("Object mapper cannot be null");
+ throw new ComponentInitializationException("ObjectMapper cannot be null");
}
if (metadataPolicyLookupStrategy == null) {
throw new ComponentInitializationException("Metadata policy lookup strategy cannot be null");
}
-
- if (issuerLookupStrategy == null) {
- throw new ComponentInitializationException("Issuer lookup strategy cannot be null");
- }
}
/** {@inheritDoc} */
@@ -268,28 +266,28 @@ public class IssueRegistrationAccessToken extends AbstractProfileAction {
metadataPolicy = metadataPolicyLookupStrategy.apply(profileRequestContext);
// null is not allowed - empty metadata policy is
if (metadataPolicy == null) {
- log.warn("{} No metadata policy could be resolved, nothing to do", getLogPrefix());
+ log.warn("{} No metadata policy could be resolved", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
return false;
}
issuer = issuerLookupStrategy.apply(profileRequestContext);
if (issuer == null) {
- log.warn("{} No issuer could be resolved, nothing to do", getLogPrefix());
+ log.warn("{} No issuer could be resolved", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
return false;
}
relyingPartyId = relyingPartyIdLookupStrategy.apply(profileRequestContext);
if (relyingPartyId == null) {
- log.warn("{} No relying party ID could be resolved, nothing to do", getLogPrefix());
+ log.warn("{} No relying party ID could be resolved", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
return false;
}
tokenLifetime = tokenLifetimeLookupStrategy.apply(profileRequestContext);
if (tokenLifetime == null) {
- log.warn("{} No token lifetime could be resolved, nothing to do", getLogPrefix());
+ log.warn("{} No token lifetime could be resolved", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
return false;
}
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index ea8b3590..e73ac985 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -264,13 +264,17 @@
</property>
</bean>
+ <!-- Used in various places as a default for issuer. -->
+ <bean id="shibboleth.oidc.issuer" class="java.lang.String" c:_0="%{idp.oidc.issuer:%{idp.entityID}}" />
+
<bean parent="shibboleth.AdminFlow"
- c:id="http://shibboleth.net/ns/profiles/oidc/issue-registration-access-token"
+ class="net.shibboleth.idp.plugin.oidc.op.admin.IssueRegistrationTokenFlowDescriptor"
p:loggingId="%{idp.oidc.issue-registration-access-token.logging:IssueRegistrationAccessToken}"
p:policyName="%{idp.oidc.issue-registration-access-token.accessPolicy:AccessByIPAddress}"
- p:nonBrowserSupported="%{idp.oidc.issue-registration-access-token.nonBrowserSupported:false}"
+ p:nonBrowserSupported="%{idp.oidc.issue-registration-access-token.nonBrowserSupported:true}"
p:authenticated="%{idp.oidc.issue-registration-access-token.authenticated:false}"
- p:resolveAttributes="%{idp.oidc.issue-registration-access-token.resolveAttributes:false}">
+ p:resolveAttributes="%{idp.oidc.issue-registration-access-token.resolveAttributes:false}"
+ p:issuer-ref="shibboleth.oidc.issuer">
<property name="postAuthenticationFlows">
<bean parent="shibboleth.CommaDelimStringArray"
c:_0="#{'%{idp.oidc.issue-registration-access-token.postAuthenticationFlows:}'.trim()}" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/oidc/issue-registration-access-token/issue-registration-access-token-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/oidc/issue-registration-access-token/issue-registration-access-token-beans.xml
index b6c19e6e..e0ae4819 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/oidc/issue-registration-access-token/issue-registration-access-token-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/oidc/issue-registration-access-token/issue-registration-access-token-beans.xml
@@ -33,12 +33,8 @@
p:httpServletResponse-ref="shibboleth.HttpServletResponse"
p:sealer-ref="#{'%{idp.oidc.dynreg.tokenSealer:shibboleth.oidc.TokenSealer}'.trim()}"
p:objectMapper-ref="shibboleth.oidc.JSONObjectMapper"
- p:metadataPolicyLookupStrategy-ref="%{idp.oidc.admin.registration.lookup.policy:shibboleth.oidc.admin.DefaultMetadataPolicyLookupStrategy}"
- p:issuerLookupStrategy-ref="%{idp.oidc.admin.registration.lookup.issuer:shibboleth.oidc.admin.DefaultIssuerLookupStrategy}"/>
+ p:metadataPolicyLookupStrategy-ref="%{idp.oidc.admin.registration.lookup.policy:shibboleth.oidc.admin.DefaultMetadataPolicyLookupStrategy}" />
- <bean id="shibboleth.oidc.admin.DefaultIssuerLookupStrategy" parent="shibboleth.Functions.Constant"
- c:target="%{idp.oidc.issuer:%{idp.entityID:}}" />
-
<bean id="shibboleth.oidc.admin.DefaultMetadataPolicyLookupStrategy"
class="net.shibboleth.oidc.profile.config.navigate.ResolverBasedRegistrationMetadataPolicyLookupFunction"
p:metadataPolicyResolver-ref="shibboleth.oidc.admin.DefaultMetadataPolicyResolver"
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index b52ed7a2..3e626786 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -11,15 +11,13 @@
default-init-method="initialize" default-destroy-method="destroy">
- <bean id="issuer" class="java.lang.String" c:_0="%{idp.oidc.issuer:%{idp.entityID}}" />
-
<!-- OIDC Profile Configurations. -->
<bean id="AbstractOIDCProfile" abstract="true"
p:securityConfiguration-ref="%{idp.security.oidc.config:shibboleth.oidc.DefaultSecurityConfiguration}" />
<bean id="AbstractOIDCSSOProfile" parent="AbstractOIDCProfile" abstract="true"
- p:issuer-ref="issuer"
+ p:issuer-ref="shibboleth.oidc.issuer"
p:tokenEndpointAuthMethods="%{idp.oidc.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}"
p:claimsValidator-ref="DefaultJWTClaimsValidator"
p:encryptionOptional="%{idp.oidc.encryptionOptional:true}"
@@ -40,13 +38,13 @@
<bean id="OIDC.UserInfo" parent="AbstractOIDCProfile" lazy-init="true"
class="net.shibboleth.oidc.profile.config.OIDCUserInfoConfiguration"
- p:issuer-ref="issuer"
+ p:issuer-ref="shibboleth.oidc.issuer"
p:encryptionOptional="%{idp.oidc.encryptionOptional:true}"
p:deniedUserInfoAttributes="%{idp.oidc.deniedUserInfoAttributes:}" />
<bean id="OIDC.Registration" parent="AbstractOIDCProfile" lazy-init="true"
class="net.shibboleth.oidc.profile.config.OIDCDynamicRegistrationConfiguration"
- p:issuer-ref="issuer"
+ p:issuer-ref="shibboleth.oidc.issuer"
p:registrationValidityPeriod="%{idp.oidc.dynreg.defaultRegistrationValidity:PT24H}"
p:secretExpirationPeriod="%{idp.oidc.dynreg.defaultSecretExpiration:P12M}"
p:tokenEndpointAuthMethods="%{idp.oidc.dynreg.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}"
@@ -55,7 +53,7 @@
<bean id="OIDC.Configuration" parent="AbstractOIDCProfile" lazy-init="true"
class="net.shibboleth.oidc.profile.config.OIDCProviderInformationConfiguration"
- p:issuer-ref="issuer" />
+ p:issuer-ref="shibboleth.oidc.issuer" />
<bean id="OIDC.Keyset" parent="AbstractOIDCProfile" lazy-init="true"
class="net.shibboleth.oidc.profile.config.OIDCPublishKeySetConfiguration"
@@ -67,21 +65,21 @@
<bean id="OAUTH2.TokenAudience" parent="AbstractOIDCProfile" lazy-init="true"
class="net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenAudienceConfiguration"
- p:issuer-ref="issuer"
+ p:issuer-ref="shibboleth.oidc.issuer"
p:encryptionOptional="%{idp.oauth2.encryptionOptional:false}"
p:accessTokenType="%{idp.oauth2.accessToken.type:}"
p:accessTokenLifetime="%{idp.oauth2.accessToken.defaultLifetime:PT10M}" />
<bean id="OAUTH2.Introspection" parent="AbstractOIDCProfile" lazy-init="true"
class="net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenIntrospectionConfiguration"
- p:issuer-ref="issuer"
+ p:issuer-ref="shibboleth.oidc.issuer"
p:tokenEndpointAuthMethods="%{idp.oidc.dynreg.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}"
p:claimsValidator-ref="DefaultJWTClaimsValidator"
p:issuedClaimsValidator-ref="DefaultIntrospectionJWTClaimsValidator" />
<bean id="OAUTH2.Revocation" parent="AbstractOIDCProfile" lazy-init="true"
class="net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenRevocationConfiguration"
- p:issuer-ref="issuer"
+ p:issuer-ref="shibboleth.oidc.issuer"
p:tokenEndpointAuthMethods="%{idp.oidc.dynreg.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}"
p:claimsValidator-ref="DefaultJWTClaimsValidator"
p:issuedClaimsValidator-ref="DefaultRevocationJWTClaimsValidator" />
@@ -127,7 +125,7 @@
<bean id="AbstractMDDrivenOAuthTokenValidatingProfile" parent="AbstractMDDrivenOAuthClientAuthenticatableProfile" abstract="true">
<property name="issuerLookupStrategy">
- <bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="issuer" p:defaultValue-ref="issuer" />
+ <bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="issuer" p:defaultValue-ref="shibboleth.oidc.issuer" />
</property>
</bean>
@@ -168,7 +166,7 @@
<bean id="AbstractMDDrivenOIDCSSOProfile" parent="AbstractMDDrivenOIDCFlowAwareProfile" abstract="true">
<property name="issuerLookupStrategy">
- <bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="issuer" p:defaultValue-ref="issuer" />
+ <bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="issuer" p:defaultValue-ref="shibboleth.oidc.issuer" />
</property>
<property name="tokenEndpointAuthMethodsLookupStrategy">
<bean parent="shibboleth.MDDrivenSetProperty" p:propertyName="tokenEndpointAuthMethods">
@@ -284,7 +282,7 @@
<bean id="OIDC.UserInfo.MDDriven" parent="AbstractMDDrivenOIDCProfile" lazy-init="true"
class="net.shibboleth.oidc.profile.config.OIDCUserInfoConfiguration">
<property name="issuerLookupStrategy">
- <bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="issuer" p:defaultValue-ref="issuer" />
+ <bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="issuer" p:defaultValue-ref="shibboleth.oidc.issuer" />
</property>
<property name="resolveAttributesPredicate">
<bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
@@ -316,7 +314,7 @@
<bean id="OIDC.Registration.MDDriven" parent="AbstractMDDrivenOIDCFlowAwareProfile" lazy-init="true"
class="net.shibboleth.oidc.profile.config.OIDCDynamicRegistrationConfiguration">
<property name="issuerLookupStrategy">
- <bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="issuer" p:defaultValue-ref="issuer" />
+ <bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="issuer" p:defaultValue-ref="shibboleth.oidc.issuer" />
</property>
<property name="tokenEndpointAuthMethodsLookupStrategy">
<bean parent="shibboleth.MDDrivenSetProperty" p:propertyName="tokenEndpointAuthMethods">
@@ -346,7 +344,7 @@
<bean id="OIDC.Configuration.MDDriven" parent="AbstractMDDrivenOIDCProfile" lazy-init="true"
class="net.shibboleth.oidc.profile.config.OIDCProviderInformationConfiguration">
<property name="issuerLookupStrategy">
- <bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="issuer" p:defaultValue-ref="issuer" />
+ <bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="issuer" p:defaultValue-ref="shibboleth.oidc.issuer" />
</property>
</bean>
@@ -380,7 +378,7 @@
<bean id="OAUTH2.TokenAudience.MDDriven" parent="AbstractMDDrivenOIDCProfile" lazy-init="true"
class="net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenAudienceConfiguration">
<property name="issuerLookupStrategy">
- <bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="issuer" p:defaultValue-ref="issuer" />
+ <bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="issuer" p:defaultValue-ref="shibboleth.oidc.issuer" />
</property>
<property name="resolveAttributesPredicate">
<bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
diff --git a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
index 68540acb..f183e9e7 100644
--- a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
+++ b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
@@ -93,6 +93,14 @@ idp.oidc.subject.salt = this_too_should_be_ch4ng3d
# contains headers further configurable via other properties such as 'idp.hsts', 'idp.frameoptions' and 'idp.csp'.
#idp.oidc.ResponseHeaderFilter = shibboleth.ResponseHeaderFilter
+# Settings for issue-registration-access-token flow
+#idp.oidc.issue-registration-access-token.logging = IssueRegistrationAccessToken
+#idp.oidc.issue-registration-access-token.accessPolicy = AccessByIPAddress
+#idp.oidc.issue-registration-access-token.nonBrowserSupported = true
+#idp.oidc.issue-registration-access-token.authenticated = false
+#idp.oidc.issue-registration-access-token.resolveAttributes = false
+#idp.oidc.admin.registration.lookup.policy = shibboleth.oidc.admin.DefaultMetadataPolicyLookupStrategy
+
#
# OAuth2 Settings - these typically involve generic OAuth 2.0 use cases
#
@@ -115,7 +123,3 @@ idp.oidc.subject.salt = this_too_should_be_ch4ng3d
# Regular expression matching OAuth login flows to enable.
# For most deployments, the default is sufficient to accomodate a variety of methods
#idp.oauth2.authn.flows = OAuth2Client
-
-# Beans to be used by the issue-registration-access-token flow
-#idp.oidc.admin.registration.function.policy = shibboleth.oidc.admin.DefaultMetadataPolicyLookupStrategy
-#idp.oidc.admin.registration.function.issuer = shibboleth.oidc.admin.DefaultIssuerLookupStrategy
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list