[java-idp-oidc] branch main updated: JOIDC-128 - Support OAuth authorization requests

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=13dbafa83d9ed2ceded37307eba404dcc6242eb2

The following commit(s) were added to refs/heads/main by this push:
     new 13dbafa8 JOIDC-128 - Support OAuth authorization requests
13dbafa8 is described below

commit 13dbafa83d9ed2ceded37307eba404dcc6242eb2
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Nov 11 16:45:29 2022 +0200

    JOIDC-128 - Support OAuth authorization requests
    
    https://shibboleth.atlassian.net/browse/JOIDC-128
    
    Included example rule for subject with OAuth authorization requests (no
    openid -scope involved).
---
 .../op/conf/examples/oidc-attribute-filter.xml     | 26 ++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/examples/oidc-attribute-filter.xml b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/examples/oidc-attribute-filter.xml
index e1c7e4ae..cdd4293d 100644
--- a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/examples/oidc-attribute-filter.xml
+++ b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/examples/oidc-attribute-filter.xml
@@ -12,6 +12,10 @@
     as long as the resolver and/or registry rules match.
     -->
 
+    <!--
+    This demonstrates how subject is set when 'openid' -scope is involved. That scope is required in
+    OIDC sequences.
+    -->
     <AttributeFilterPolicy id="OPENID_SCOPE">
         <PolicyRequirementRule xsi:type="oidc:OIDCScope" value="openid" />
         <!-- May adjust to taste depending on strategy used to produce sub claim. -->
@@ -26,6 +30,28 @@
         </AttributeRule>
     </AttributeFilterPolicy>
 
+    <!--
+    This demonstrates how subject is set with "plain" OAuth authorization sequences, i.e. when 'openid'
+    scope is not involved.
+    -->
+    <AttributeFilterPolicy id="OAUTH_SUBJECT">
+        <PolicyRequirementRule xsi:type="AND">
+            <Rule xsi:type="NOT">
+                <Rule xsi:type="oidc:OIDCScope" value="openid" />
+            </Rule>
+            <Rule xsi:type="Profile" value="http://shibboleth.net/ns/profiles/oidc/sso/browser" />
+        </PolicyRequirementRule>
+        <AttributeRule attributeID="subject">
+            <PermitValueRule xsi:type="ANY" />
+        </AttributeRule>
+        <AttributeRule attributeID="subject-public">
+            <PermitValueRule xsi:type="ANY" />
+        </AttributeRule>
+        <AttributeRule attributeID="subject-pairwise">
+            <PermitValueRule xsi:type="ANY" />
+        </AttributeRule>
+    </AttributeFilterPolicy>
+
     <!--
     This demonstrates a rule that releases email claims in response to requests having the 'email' scope.
     The requester needs to have that as a registered scope.

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.