[java-idp-oidc] branch main updated: JOIDC-132 - Improve customization methods for the configuration flow
Henri Mikkonen
henri.mikkonen at iki.fi
Fri Nov 4 12:58:42 UTC 2022
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=880f7cdb538768ccdf6a22bdd7748d411460f30b
The following commit(s) were added to refs/heads/main by this push:
new 880f7cdb JOIDC-132 - Improve customization methods for the configuration flow
880f7cdb is described below
commit 880f7cdb538768ccdf6a22bdd7748d411460f30b
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Nov 4 14:56:32 2022 +0200
JOIDC-132 - Improve customization methods for the configuration flow
https://shibboleth.atlassian.net/browse/JOIDC-132
Support new property 'idp.oidc.discovery.resolver.values' for easier
configuration of dynamic claims for the configuration flow response.
FunctionMetadataValueResolver helps in providing values via Functions.
---
.../impl/FunctionMetadataValueResolver.java | 84 ++++++++++++++++++++++
.../META-INF/net.shibboleth.idp/postconfig.xml | 26 +++++++
.../oidc/configuration/configuration-beans.xml | 28 +-------
.../idp/plugin/oidc/op/conf/oidc.properties | 7 ++
.../op/profile/flow/ConfigurationFlowTest.java | 2 +
.../src/test/resources/conf/global.xml | 15 ++++
.../src/test/resources/conf/oidc.properties | 2 +
7 files changed, 138 insertions(+), 26 deletions(-)
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/metadata/impl/FunctionMetadataValueResolver.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/metadata/impl/FunctionMetadataValueResolver.java
new file mode 100644
index 00000000..608cd357
--- /dev/null
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/metadata/impl/FunctionMetadataValueResolver.java
@@ -0,0 +1,84 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.oidc.op.metadata.impl;
+
+import java.util.List;
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.idp.plugin.oidc.op.metadata.resolver.MetadataValueResolver;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.utilities.java.support.component.AbstractIdentifiableInitializableComponent;
+import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
+import net.shibboleth.utilities.java.support.component.ComponentSupport;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.resolver.ResolverException;
+
+/**
+ * An implementation of {@link MetadataValueResolver} that resolves the value via attached {@link Function}.
+ */
+public class FunctionMetadataValueResolver extends AbstractIdentifiableInitializableComponent
+ implements MetadataValueResolver {
+
+ /** The function used for resolving the value. */
+ @NonnullAfterInit private Function<ProfileRequestContext, Object> resolverFunction;
+
+ /**
+ * Constructor.
+ */
+ public FunctionMetadataValueResolver() {
+ // no op
+ }
+
+ /**
+ * Set the function used for resolving the value.
+ *
+ * @param function What to set.
+ */
+ public void setResolverFunction(@Nonnull final Function<ProfileRequestContext, Object> function) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ resolverFunction = Constraint.isNotNull(function, "Resolver function cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ protected void doInitialize() throws ComponentInitializationException {
+ super.doInitialize();
+
+ if (resolverFunction == null) {
+ throw new ComponentInitializationException("Resolver function can not be null");
+ }
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public Iterable<Object> resolve(@Nonnull final ProfileRequestContext criteria) throws ResolverException {
+ return List.of(resolveSingle(criteria));
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public Object resolveSingle(@Nonnull final ProfileRequestContext criteria) throws ResolverException {
+ return resolverFunction.apply(criteria);
+ }
+
+}
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 9bf878ff..5eb8e817 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -560,4 +560,30 @@
<bean id="shibboleth.oidc.Conditions.ValidatedScope"
class="net.shibboleth.idp.plugin.oidc.op.messaging.context.logic.ValidatedScopePredicate" abstract="true" />
+ <bean id="shibboleth.oidc.discovery.DefaultDynamicValueResolvers"
+ class="org.springframework.beans.factory.config.MapFactoryBean">
+ <property name="sourceMap">
+ <map>
+ <entry key="id_token_signing_alg_values_supported" value-ref="shibboleth.oidc.discovery.SignatureAlgorithmInfoResolver" />
+ <entry key="userinfo_signing_alg_values_supported" value-ref="shibboleth.oidc.discovery.SignatureAlgorithmInfoResolver" />
+ <entry key="id_token_encryption_enc_values_supported" value-ref="shibboleth.oidc.discovery.DataEncryptionAlgorithmInfoResolver" />
+ <entry key="userinfo_encryption_enc_values_supported" value-ref="shibboleth.oidc.discovery.DataEncryptionAlgorithmInfoResolver" />
+ <entry key="id_token_encryption_alg_values_supported" value-ref="shibboleth.oidc.discovery.KeyTransportEncryptionAlgorithmInfoResolver" />
+ <entry key="userinfo_encryption_alg_values_supported" value-ref="shibboleth.oidc.discovery.KeyTransportEncryptionAlgorithmInfoResolver" />
+ </map>
+ </property>
+ </bean>
+
+ <bean id="shibboleth.oidc.discovery.SignatureAlgorithmInfoResolver"
+ class="net.shibboleth.idp.plugin.oidc.op.metadata.impl.AlgorithmInfoMetadataValueResolver"
+ p:resolveEncryptionAlgs="false" />
+
+ <bean id="shibboleth.oidc.discovery.DataEncryptionAlgorithmInfoResolver"
+ class="net.shibboleth.idp.plugin.oidc.op.metadata.impl.AlgorithmInfoMetadataValueResolver"
+ p:resolveEncryptionAlgs="true" p:resolveKeyTransportEncAlgs="false" />
+
+ <bean id="shibboleth.oidc.discovery.KeyTransportEncryptionAlgorithmInfoResolver"
+ class="net.shibboleth.idp.plugin.oidc.op.metadata.impl.AlgorithmInfoMetadataValueResolver"
+ p:resolveEncryptionAlgs="true" p:resolveKeyTransportEncAlgs="true" />
+
</beans>
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/configuration/configuration-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/configuration/configuration-beans.xml
index d3025f0c..c7d65287 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/configuration/configuration-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/configuration/configuration-beans.xml
@@ -29,34 +29,10 @@
class="net.shibboleth.idp.plugin.oidc.op.metadata.impl.DynamicFilesystemProviderMetadataResolver"
p:minRefreshDelay="%{idp.oidc.config.minRefreshDelay:PT5M}"
p:maxRefreshDelay="%{idp.oidc.config.maxRefreshDelay:PT4H}"
- c:metadata="#{getObject('shibboleth.oidc.OpenIDConfiguration') ?: getObject('DefaultMetadataSkeleton')}">
- <property name="dynamicValueResolvers">
- <map value-type="net.shibboleth.idp.plugin.oidc.op.metadata.resolver.MetadataValueResolver">
- <entry key="id_token_signing_alg_values_supported" value-ref="SignatureAlgorithmInfoResolver" />
- <entry key="userinfo_signing_alg_values_supported" value-ref="SignatureAlgorithmInfoResolver" />
- <entry key="id_token_encryption_enc_values_supported" value-ref="DataEncryptionAlgorithmInfoResolver" />
- <entry key="userinfo_encryption_enc_values_supported" value-ref="DataEncryptionAlgorithmInfoResolver" />
- <entry key="id_token_encryption_alg_values_supported" value-ref="KeyTransportEncryptionAlgorithmInfoResolver" />
- <entry key="userinfo_encryption_alg_values_supported" value-ref="KeyTransportEncryptionAlgorithmInfoResolver" />
- </map>
- </property>
- </bean>
+ c:metadata="#{getObject('shibboleth.oidc.OpenIDConfiguration') ?: getObject('DefaultMetadataSkeleton')}"
+ p:dynamicValueResolvers-ref="#{'%{idp.oidc.discovery.resolver.values:shibboleth.oidc.discovery.DefaultDynamicValueResolvers}'.trim()}"/>
<bean id="DefaultMetadataSkeleton" class="org.springframework.core.io.FileSystemResource" lazy-init="true"
c:path="%{idp.oidc.discovery.template:%{idp.home}/static/openid-configuration.json}" />
- <bean id="CredentialResolver" class="net.shibboleth.idp.plugin.oidc.op.metadata.impl.CredentialMetadataValueResolver" />
-
- <bean id="SignatureAlgorithmInfoResolver"
- class="net.shibboleth.idp.plugin.oidc.op.metadata.impl.AlgorithmInfoMetadataValueResolver"
- p:resolveEncryptionAlgs="false" />
-
- <bean id="DataEncryptionAlgorithmInfoResolver"
- class="net.shibboleth.idp.plugin.oidc.op.metadata.impl.AlgorithmInfoMetadataValueResolver"
- p:resolveEncryptionAlgs="true" p:resolveKeyTransportEncAlgs="false" />
-
- <bean id="KeyTransportEncryptionAlgorithmInfoResolver"
- class="net.shibboleth.idp.plugin.oidc.op.metadata.impl.AlgorithmInfoMetadataValueResolver"
- p:resolveEncryptionAlgs="true" p:resolveKeyTransportEncAlgs="true" />
-
</beans>
diff --git a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
index 776e5ab0..00b4dc6e 100644
--- a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
+++ b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
@@ -114,6 +114,13 @@ idp.oidc.subject.salt = this_too_should_be_ch4ng3d
#idp.oidc.admin.registration.policyIdPolicy = AccessByAdmin
#idp.oidc.admin.registration.clientIdPolicy = AccessByAdmin
+# Settings for the configuration flow
+# Flow is available at /oidc/configuration, usually it should be wired from /.well-known/openid-configuration
+#idp.oidc.discovery.template = %{idp.home}/static/openid-configuration.json
+#idp.oidc.discovery.resolver = shibboleth.oidc.DefaultOpenIdConfigurationResolver
+#idp.oidc.discovery.resolver.values = shibboleth.oidc.discovery.DefaultDynamicValueResolvers
+
+
#
# OAuth2 Settings - these typically involve generic OAuth 2.0 use cases
#
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ConfigurationFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ConfigurationFlowTest.java
index 9ea82ced..17d82f50 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ConfigurationFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ConfigurationFlowTest.java
@@ -81,6 +81,8 @@ public class ConfigurationFlowTest extends AbstractOidcFlowTest {
Assert.assertTrue(containsAll(metadata.getUserInfoJWEEncs(), jweEncs));
Assert.assertNotNull(metadata.getUserInfoJWEEncs());
Assert.assertTrue(containsAll(metadata.getUserInfoJWSAlgs(), jwsAlgs));
+ Assert.assertNotNull(metadata.getCustomParameter("STATIC_TEST_ATTRIBUTE"));
+ Assert.assertEquals(metadata.getCustomParameter("STATIC_TEST_ATTRIBUTE"), "TestValue");
}
protected boolean containsAll(Collection<? extends Algorithm> algs, Collection<String> strings) {
diff --git a/idp-oidc-extension-impl/src/test/resources/conf/global.xml b/idp-oidc-extension-impl/src/test/resources/conf/global.xml
index 925dd47f..1fad6f00 100644
--- a/idp-oidc-extension-impl/src/test/resources/conf/global.xml
+++ b/idp-oidc-extension-impl/src/test/resources/conf/global.xml
@@ -87,4 +87,19 @@
</constructor-arg>
</bean>
+ <bean id="CustomConfigurationValues" parent="shibboleth.oidc.discovery.DefaultDynamicValueResolvers"
+ class="org.springframework.beans.factory.config.MapFactoryBean">
+ <property name="sourceMap">
+ <map merge="true">
+ <entry key="STATIC_TEST_ATTRIBUTE">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.metadata.impl.FunctionMetadataValueResolver">
+ <property name="resolverFunction">
+ <bean parent="shibboleth.Functions.Constant" c:target="TestValue"/>
+ </property>
+ </bean>
+ </entry>
+ </map>
+ </property>
+ </bean>
+
</beans>
diff --git a/idp-oidc-extension-impl/src/test/resources/conf/oidc.properties b/idp-oidc-extension-impl/src/test/resources/conf/oidc.properties
index 8da1d21c..b5bea8ba 100644
--- a/idp-oidc-extension-impl/src/test/resources/conf/oidc.properties
+++ b/idp-oidc-extension-impl/src/test/resources/conf/oidc.properties
@@ -16,3 +16,5 @@ idp.oidc.dynreg.defaultMetadataPolicyFile = src/test/resources/conf/metadata-pol
idp.oauth2.grantTypes = authorization_code,refresh_token,client_credentials
idp.oauth2.defaultAllowedAudience = https://rp.example.org
+
+idp.oidc.discovery.resolver.values = CustomConfigurationValues
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list