[java-idp-plugin-oidc-rp] branch main updated: Bean name changes and formatting
Phil Smart
philip.smart at jisc.ac.uk
Fri May 6 13:34:19 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=93c136950af18afe6011df55dd4aef4b25cebdaf
The following commit(s) were added to refs/heads/main by this push:
new 93c1369 Bean name changes and formatting
93c1369 is described below
commit 93c136950af18afe6011df55dd4aef4b25cebdaf
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri May 6 14:34:13 2022 +0100
Bean name changes and formatting
---
.../oidc-relying-party-authn-beans.xml | 5 +-
.../oidc-relying-party-authn-flow.xml | 169 +++++++++++----------
2 files changed, 92 insertions(+), 82 deletions(-)
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
index 4a34e36..b544ef6 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
@@ -256,7 +256,7 @@
<bean id="PopulateIDTokenSignatureValidationParameters" parent="NestedWebFlowProfileActionAdaptor"
scope="prototype">
<constructor-arg>
- <bean class="net.shibboleth.oidc.security.impl.GenericPopulateSignatureValidationParameters"
+ <bean class="net.shibboleth.oidc.security.impl.PopulateJWTSignatureValidationParameters"
p:configurationLookupStrategy-ref="shibboleth.authn.oidc.rp.IDTokenSignatureValidationConfigurationLookup"
p:signatureValidationParametersResolver-ref="shibboleth.authn.oidc.rp.IDTokenJwtSignatureValidationParametersResolver" />
</constructor-arg>
@@ -270,7 +270,8 @@
p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
- <bean id="HandleIDTokenSignature" parent="NestedWebFlowMessageHandlerAdaptor" scope="prototype"
+ <!-- TODO decryption as well? -->
+ <bean id="HandleIDTokenValidation" parent="NestedWebFlowMessageHandlerAdaptor" scope="prototype"
c:executionDirection="INBOUND">
<constructor-arg>
<bean class="org.opensaml.messaging.handler.impl.BasicMessageHandlerChain">
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-flow.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-flow.xml
index f69d904..8a2a9b9 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-flow.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-flow.xml
@@ -1,152 +1,161 @@
<flow xmlns="http://www.springframework.org/schema/webflow" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/webflow http://www.springframework.org/schema/webflow/spring-webflow.xsd"
- parent="authn.abstract, authn/conditions">
-
- <!-- This is a login flow for proxied authentication implemented via OIDC -->
-
+ xsi:schemaLocation="http://www.springframework.org/schema/webflow http://www.springframework.org/schema/webflow/spring-webflow.xsd"
+ parent="authn.abstract, authn/conditions">
+
+ <!-- This is a login flow for proxied authentication implemented via OIDC -->
+
<!-- OP discovery? -->
<on-start>
<!-- If installed, this can bypass discovery. -->
- <evaluate expression="flowRequestContext.getActiveFlow().getApplicationContext().containsBean('shibboleth.authn.oidc.rp.discoveryFunction') ? flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.authn.oidc.rp.discoveryFunction') : PropertyDrivenDiscovery" result="flowScope.customDiscovery" />
- <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).setAuthenticatingAuthority(customDiscovery.apply(opensamlProfileRequestContext))" />
+ <evaluate
+ expression="flowRequestContext.getActiveFlow().getApplicationContext().containsBean('shibboleth.authn.oidc.rp.discoveryFunction') ? flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.authn.oidc.rp.discoveryFunction') : PropertyDrivenDiscovery"
+ result="flowScope.customDiscovery" />
+ <evaluate
+ expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).setAuthenticatingAuthority(customDiscovery.apply(opensamlProfileRequestContext))" />
</on-start>
-
+
<action-state id="Start">
<evaluate expression="'proceed'" />
<transition on="proceed" to="DoDiscovery" />
</action-state>
-
+
<action-state id="PostDiscovery">
<!-- Nest new PRC inside AC -->
- <evaluate expression="InitializeProxyProfileRequestContext" />
+ <evaluate expression="InitializeProxyProfileRequestContext" />
<evaluate expression="FlowStartPopulateAuditContext" />
<!-- Init inbound msg context and create OP Peer -->
<evaluate expression="PrepareOIDCInboundMessageContext" />
-
- <evaluate expression="OIDCProviderMetadataLookup" />
+
+ <evaluate expression="OIDCProviderMetadataLookup" />
<evaluate expression="InitializeRelyingPartyContext" />
<evaluate expression="SelectRelyingPartyConfiguration" />
-
- <!-- <evaluate expression="PostLookupPopulateAuditContext" /> -->
+
+ <!-- <evaluate expression="PostLookupPopulateAuditContext" /> -->
<evaluate expression="InitializeOutboundMessageContext" />
<evaluate expression="SelectProfileConfiguration" />
- <evaluate expression="InitializeOAuth2ClientContext" />
- <evaluate expression="PopulateResponseTypeAndModeContext"/>
- <evaluate expression="AddOIDCAuthenticationRequest"/>
- <!-- <evaluate expression="PostRequestPopulateAuditContext" />
- <evaluate expression="WriteAuditLog" /> -->
-
- <!--
- <evaluate expression="InitializeMessageChannelSecurityContext" />
- -->
+ <evaluate expression="InitializeOAuth2ClientContext" />
+ <evaluate expression="PopulateResponseTypeAndModeContext" />
+ <evaluate expression="AddOIDCAuthenticationRequest" />
+ <!-- <evaluate expression="PostRequestPopulateAuditContext" /> <evaluate expression="WriteAuditLog" /> -->
+
+ <!-- <evaluate expression="InitializeMessageChannelSecurityContext" /> -->
<evaluate expression="'proceed'" />
-
+
<transition on="proceed" to="AuthRequest" />
</action-state>
<view-state id="AuthRequest"
view="externalRedirect:#{T(net.shibboleth.idp.authn.ExternalAuthentication).getExternalRedirect(flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.authn.OIDC.externalAuthnPath'), flowExecutionContext.getKey().toString())}">
- <attribute name="csrf_excluded" value="true" type="boolean" />
+ <attribute name="csrf_excluded" value="true" type="boolean" />
<on-render>
<evaluate
expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).addSubcontext(new net.shibboleth.idp.authn.context.ExternalAuthenticationContext(new net.shibboleth.idp.authn.impl.ExternalAuthenticationImpl(false)), true).setFlowExecutionUrl(flowExecutionUrl + '&_eventId_proceed=1')" />
- <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).addSubcontext(new net.shibboleth.idp.plugin.authn.oidc.rp.context.OIDCAuthnContext(EncodeMessage, messageDecoderFactory), true)" result="flowScope.oidcContext" />
+ <evaluate
+ expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).addSubcontext(new net.shibboleth.idp.plugin.authn.oidc.rp.context.OIDCAuthnContext(EncodeMessage, messageDecoderFactory), true)"
+ result="flowScope.oidcContext" />
<evaluate expression="flowScope.oidcContext.setOutboundMessageHandler(PreEncodeMessageHandler)" />
- </on-render>
+ </on-render>
<transition to="ValidateResponse" />
</view-state>
<action-state id="ValidateResponse">
- <evaluate expression="ValidateExternalAuthenticationContext"/>
- <evaluate expression="ValidateAuthenticationResponseResult"/>
- <evaluate expression="ValidateResponseStateMatchesRequest"/>
- <!-- Add a new OIDCPeerEntityContext to inbound authentication response context
- using the original authenticating authority. The OIDC response does not contain an issuer (this is
- later tested in the id_token) matched against the original provider metadata -->
- <evaluate expression="AddPeerEntityContextToInboundMessage"/>
+ <evaluate expression="ValidateExternalAuthenticationContext" />
+ <evaluate expression="ValidateAuthenticationResponseResult" />
+ <evaluate expression="ValidateResponseStateMatchesRequest" />
+ <!-- Add a new OIDCPeerEntityContext to inbound authentication response context using the original authenticating
+ authority. The OIDC response does not contain an issuer (this is later tested in the id_token) matched against the original
+ provider metadata -->
+ <evaluate expression="AddPeerEntityContextToInboundMessage" />
<evaluate expression="'proceed'" />
<transition on="proceed" to="SwitchOnGrantType" />
</action-state>
-
- <!-- Switch flow path based on OIDC grant_type used.
- TODO possible places for an NPE, use strategy?-->
+
+ <!-- Switch flow path based on OIDC grant_type used. TODO possible places for an NPE, use strategy? -->
<decision-state id="SwitchOnGrantType">
<!-- check a null response_type first, should never get here -->
- <if test="opensamlProfileRequestContext.getSubcontext('net.shibboleth.idp.authn.context.AuthenticationContext')
+ <if
+ test="opensamlProfileRequestContext.getSubcontext('net.shibboleth.idp.authn.context.AuthenticationContext')
.getSubcontext('org.opensaml.profile.context.ProfileRequestContext').getOutboundMessageContext().getSubcontext('net.shibboleth.idp.plugin.authn.oidc.rp.context.ResponseTypeAndModeContext').getResponseType() == null"
then="UnsupportedFlow" />
<!-- Check for CODE flow -->
- <if test="opensamlProfileRequestContext.getSubcontext('net.shibboleth.idp.authn.context.AuthenticationContext')
+ <if
+ test="opensamlProfileRequestContext.getSubcontext('net.shibboleth.idp.authn.context.AuthenticationContext')
.getSubcontext('org.opensaml.profile.context.ProfileRequestContext').getOutboundMessageContext().getSubcontext('net.shibboleth.idp.plugin.authn.oidc.rp.context.ResponseTypeAndModeContext').getResponseType().impliesCodeFlow()"
then="CodeFlow" />
<!-- Check for Hybrid flow -->
- <if test="opensamlProfileRequestContext.getSubcontext('net.shibboleth.idp.authn.context.AuthenticationContext')
+ <if
+ test="opensamlProfileRequestContext.getSubcontext('net.shibboleth.idp.authn.context.AuthenticationContext')
.getSubcontext('org.opensaml.profile.context.ProfileRequestContext').getOutboundMessageContext().getSubcontext('net.shibboleth.idp.plugin.authn.oidc.rp.context.ResponseTypeAndModeContext').getResponseType().impliesImplicitFlow()"
then="HybridFlow" />
<!-- Check for IMPLICIT flow -->
<!-- final IF has an else if an unsupported flow is used (should not happen) -->
- <if test="opensamlProfileRequestContext.getSubcontext('net.shibboleth.idp.authn.context.AuthenticationContext')
+ <if
+ test="opensamlProfileRequestContext.getSubcontext('net.shibboleth.idp.authn.context.AuthenticationContext')
.getSubcontext('org.opensaml.profile.context.ProfileRequestContext').getOutboundMessageContext().getSubcontext('net.shibboleth.idp.plugin.authn.oidc.rp.context.ResponseTypeAndModeContext').getResponseType().impliesHybridFlow()"
- then="ImplicitFlow" else="UnsupportedFlow" />
+ then="ImplicitFlow" else="UnsupportedFlow" />
</decision-state>
<action-state id="CodeFlow">
- <evaluate expression="InitializeOAuth2ClientAuthenticationContext"/>
- <evaluate expression="ExchangeCodeForAccessToken"/>
- <evaluate expression="ValidateOAuthAccessTokenResponse"/>
- <evaluate expression="ExtractIDTokenFromTokenResponse"/>
- <evaluate expression="'proceed'" />
+ <evaluate expression="InitializeOAuth2ClientAuthenticationContext" />
+ <evaluate expression="ExchangeCodeForAccessToken" />
+ <evaluate expression="ValidateOAuthAccessTokenResponse" />
+ <evaluate expression="ExtractIDTokenFromTokenResponse" />
+ <evaluate expression="'proceed'" />
<transition on="proceed" to="ValidateToken" />
</action-state>
-
-
+
+
<!-- TODO claim validation will differ per grant_type -->
<action-state id="ValidateToken">
- <evaluate expression="PopulateIDTokenSignatureValidationParameters" />
- <evaluate expression="HandleIDTokenSignature" />
<!-- <evaluate expression="PopulateTokenEncryptionParameters" /> -->
- <evaluate expression="ValidateIDTokenClaims" />
- <evaluate expression="'proceed'" />
- <transition on="proceed" to="CheckUserInfoClaimsRequired" />
+ <evaluate expression="PopulateIDTokenSignatureValidationParameters" />
+ <evaluate expression="HandleIDTokenValidation" />
+
+ <evaluate expression="ValidateIDTokenClaims" />
+ <evaluate expression="'proceed'" />
+ <transition on="proceed" to="CheckUserInfoClaimsRequired" />
</action-state>
-
+
<decision-state id="CheckUserInfoClaimsRequired">
- <if test="CheckUserInfoRequiredCondition.test(opensamlProfileRequestContext.getSubcontext('net.shibboleth.idp.authn.context.AuthenticationContext').getSubcontext('org.opensaml.profile.context.ProfileRequestContext'))"
+ <if
+ test="CheckUserInfoRequiredCondition.test(opensamlProfileRequestContext.getSubcontext('net.shibboleth.idp.authn.context.AuthenticationContext').getSubcontext('org.opensaml.profile.context.ProfileRequestContext'))"
then="UserInfoRequest" else="FinalizeResponse" />
- <!-- if else here, we need to set id_token claims into EndUserClaimsContext -->
+ <!-- if else here, we need to set id_token claims into EndUserClaimsContext -->
</decision-state>
-
- <action-state id="UserInfoRequest">
+
+ <action-state id="UserInfoRequest">
<evaluate expression="UserInfoEndpointLookup" />
<!-- Something needs to check TLS server certificate? -->
<evaluate expression="'proceed'" />
<transition on="proceed" to="CheckUserInfoResponseType" />
- </action-state>
-
- <!-- A plain JWT will skip token validation and go straight to claim validation -->
- <decision-state id="CheckUserInfoResponseType">
- <if test="CheckUserInfoSignedJWTResponseTypeCondition.test(opensamlProfileRequestContext.getSubcontext('net.shibboleth.idp.authn.context.AuthenticationContext').getSubcontext('org.opensaml.profile.context.ProfileRequestContext'))"
+ </action-state>
+
+ <!-- A plain JWT will skip token validation and go straight to claim validation -->
+ <decision-state id="CheckUserInfoResponseType">
+ <if
+ test="CheckUserInfoSignedJWTResponseTypeCondition.test(opensamlProfileRequestContext.getSubcontext('net.shibboleth.idp.authn.context.AuthenticationContext').getSubcontext('org.opensaml.profile.context.ProfileRequestContext'))"
then="ValidateSignedUserInfoJWT" />
- <if test="CheckUserInfoEncryptedJWTResponseTypeCondition.test(opensamlProfileRequestContext.getSubcontext('net.shibboleth.idp.authn.context.AuthenticationContext').getSubcontext('org.opensaml.profile.context.ProfileRequestContext'))"
- then="DecryptUserInfoJWT"
- else="ValidateUserInfoClaimsSet"/>
- </decision-state>
-
- <action-state id="ValidateSignedUserInfoJWT">
- <!-- <evaluate expression="PopulateUserInfoTokenSignatureValidationParameters" /> -->
+ <if
+ test="CheckUserInfoEncryptedJWTResponseTypeCondition.test(opensamlProfileRequestContext.getSubcontext('net.shibboleth.idp.authn.context.AuthenticationContext').getSubcontext('org.opensaml.profile.context.ProfileRequestContext'))"
+ then="DecryptUserInfoJWT" else="ValidateUserInfoClaimsSet" />
+ </decision-state>
+
+ <action-state id="ValidateSignedUserInfoJWT">
+ <!-- <evaluate expression="PopulateUserInfoTokenSignatureValidationParameters" /> -->
+
<evaluate expression="ValidateUserInfoToken" />
<evaluate expression="'proceed'" />
<transition on="proceed" to="ValidateUserInfoClaimsSet" />
</action-state>
-
+
<!-- TODO decrypt then check signature if signed, then check claims if signed! see 5.3.2 -->
<action-state id="DecryptUserInfoJWT">
- <!-- <evaluate expression="PopulateTokenEncryptionParameters" /> -->
- <evaluate expression="ValidateUserInfoToken" /> <!-- Will die if not decrypted properly first -->
+ <!-- <evaluate expression="PopulateTokenEncryptionParameters" /> -->
+ <evaluate expression="ValidateUserInfoToken" /> <!-- Will die if not decrypted properly first -->
<evaluate expression="'proceed'" />
<transition on="proceed" to="ValidateUserInfoClaimsSet" />
</action-state>
-
+
<action-state id="ValidateUserInfoClaimsSet">
<evaluate expression="ValidateUserInfoClaims" />
<evaluate expression="'proceed'" />
@@ -159,19 +168,19 @@
<evaluate expression="'proceed'" />
<transition on="proceed" to="proceed" />
</action-state>
-
+
<!-- Placeholders for flows which are not supported, and would not work without some front-end impl. -->
- <action-state id="HybridFlow">
+ <action-state id="HybridFlow">
<evaluate expression="'proceed'" />
<transition on="proceed" to="UnsupportedFlow" />
</action-state>
-
+
<action-state id="ImplicitFlow">
<evaluate expression="'proceed'" />
<transition on="proceed" to="UnsupportedFlow" />
</action-state>
-
- <action-state id="UnsupportedFlow">
+
+ <action-state id="UnsupportedFlow">
<evaluate expression="'proceed'" />
<transition on="proceed" to="END" />
</action-state>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list