[java-idp-oidc] branch main updated: Adjust and expose some properties.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=8ded8fa6bb2ee82fdaf9d498d3894590bd109603

The following commit(s) were added to refs/heads/main by this push:
     new 8ded8fa6 Adjust and expose some properties.
8ded8fa6 is described below

commit 8ded8fa6bb2ee82fdaf9d498d3894590bd109603
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Mar 15 08:44:57 2022 -0400

    Adjust and expose some properties.
---
 .../plugin/oidc/op/profile/impl/IssueRegistrationAccessToken.java  | 5 +++++
 .../issue-registration-access-token-beans.xml                      | 7 ++++---
 .../net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties         | 4 ++++
 idp-oidc-extension-impl/src/test/resources/conf/oidc.properties    | 4 ++++
 4 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/IssueRegistrationAccessToken.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/IssueRegistrationAccessToken.java
index 4f50cc88..a3178129 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/IssueRegistrationAccessToken.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/IssueRegistrationAccessToken.java
@@ -68,10 +68,15 @@ import net.shibboleth.utilities.java.support.security.impl.SecureRandomIdentifie
  * <p>On success, {@link AccessTokenResponse} is built and attached as a message for the outbound message context. Also
  * a proceed event is built. On error, a non-proceed event is built.</p>
  * 
+ * <p>Several access control checks are made to named policies in the case that certain options are supplied.</p>
+ * 
  * @event {@link EventIds#PROCEED_EVENT_ID}
+ * @event {@link EventIds#ACCESS_DENIED}
  * @event {@link EventIds#INVALID_MESSAGE}
  * @event {@link EventIds#INVALID_PROFILE_CTX}
  * @event {@link EventIds#IO_ERROR}
+ * 
+ * @since 3.1.0
  */
 public class IssueRegistrationAccessToken extends AbstractProfileAction {
     
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/oidc/issue-registration-access-token/issue-registration-access-token-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/oidc/issue-registration-access-token/issue-registration-access-token-beans.xml
index c723bb0b..66f19a28 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/oidc/issue-registration-access-token/issue-registration-access-token-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/oidc/issue-registration-access-token/issue-registration-access-token-beans.xml
@@ -36,9 +36,10 @@
         p:objectMapper-ref="shibboleth.oidc.JSONObjectMapper"
         p:accessControlService-ref="shibboleth.AccessControlService"
         p:metadataPolicyLookupStrategy-ref="%{idp.oidc.admin.registration.lookup.policy:shibboleth.oidc.admin.DefaultMetadataPolicyLookupStrategy}"
-        p:policyLocationPolicyName="%{idp.oidc.admin.registration.policyLocationPolicy:AccessByIPAddress}"
-        p:policyIdPolicyName="%{idp.oidc.admin.registration.policyIdPolicy:AccessByIPAddress}"
-        p:clientIdPolicyName="%{idp.oidc.admin.registration.clientIdPolicy:AccessByIPAddress}" />
+        p:defaultTokenLifetime="%{idp.oidc.admin.registration.defaultTokenLifetime:P1D}"
+        p:policyLocationPolicyName="%{idp.oidc.admin.registration.policyLocationPolicy:AccessByAdmin}"
+        p:policyIdPolicyName="%{idp.oidc.admin.registration.policyIdPolicy:AccessByAdmin}"
+        p:clientIdPolicyName="%{idp.oidc.admin.registration.clientIdPolicy:AccessByAdmin}" />
 
     <bean id="shibboleth.oidc.admin.DefaultMetadataPolicyLookupStrategy"
         class="net.shibboleth.oidc.profile.config.navigate.ResolverBasedRegistrationMetadataPolicyLookupFunction"
diff --git a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
index f183e9e7..8c981b40 100644
--- a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
+++ b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
@@ -100,6 +100,10 @@ idp.oidc.subject.salt = this_too_should_be_ch4ng3d
 #idp.oidc.issue-registration-access-token.authenticated = false
 #idp.oidc.issue-registration-access-token.resolveAttributes = false
 #idp.oidc.admin.registration.lookup.policy = shibboleth.oidc.admin.DefaultMetadataPolicyLookupStrategy
+#idp.oidc.admin.registration.defaultTokenLifetime = P1D
+#idp.oidc.admin.registration.policyLocationPolicy = AccessByAdmin
+#idp.oidc.admin.registration.policyIdPolicy = AccessByAdmin
+#idp.oidc.admin.registration.clientIdPolicy = AccessByAdmin
 
 #
 # OAuth2 Settings - these typically involve generic OAuth 2.0 use cases
diff --git a/idp-oidc-extension-impl/src/test/resources/conf/oidc.properties b/idp-oidc-extension-impl/src/test/resources/conf/oidc.properties
index 3962b287..8da1d21c 100644
--- a/idp-oidc-extension-impl/src/test/resources/conf/oidc.properties
+++ b/idp-oidc-extension-impl/src/test/resources/conf/oidc.properties
@@ -8,6 +8,10 @@ idp.oidc.discovery.template = src/test/resources/conf/openid-configuration.json
 
 idp.oidc.nodePrefix = ServerA
 
+idp.oidc.admin.registration.policyLocationPolicy = AccessByIPAddress
+idp.oidc.admin.registration.policyIdPolicy = AccessByIPAddress
+idp.oidc.admin.registration.clientIdPolicy = AccessByIPAddress
+
 idp.oidc.dynreg.defaultMetadataPolicyFile = src/test/resources/conf/metadata-policy1.json
 
 idp.oauth2.grantTypes = authorization_code,refresh_token,client_credentials

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.