[java-idp-plugin-oidc-rp] branch main updated: JOIDCRP-21 - PublishKeySet Security Configuration and Flow
Phil Smart
philip.smart at jisc.ac.uk
Thu Nov 24 17:02:42 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=5f5d4261a57bdb49709bc61cc1fd01b7ee083bc4
The following commit(s) were added to refs/heads/main by this push:
new 5f5d426 JOIDCRP-21 - PublishKeySet Security Configuration and Flow
5f5d426 is described below
commit 5f5d4261a57bdb49709bc61cc1fd01b7ee083bc4
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Thu Nov 24 17:02:39 2022 +0000
JOIDCRP-21 - PublishKeySet Security Configuration and Flow
- Add first attempt at keyset flow.
https://shibboleth.atlassian.net/browse/JOIDCRP-21
---
...ializeSimpleOutboundResponseMessageContext.java | 46 +++++++++++
.../InitializeUnverifiedRelyingPartyContext.java | 84 ++++++++++++++++++++
...ingPartyCredentialsToPublishLookupStrategy.java | 63 +++++++++++++++
.../META-INF/net.shibboleth.idp/postconfig.xml | 18 +++++
.../oidc-relying-party-authn-beans.xml | 4 +-
.../idp/flows/oidc/rp/keyset/keyset-beans.xml | 90 ++++++++++++++++++++++
.../idp/flows/oidc/rp/keyset/keyset-flow.xml | 50 ++++++++++++
.../idp/service/relying-party/postconfig.xml | 75 ++++++++++++------
.../oidc/rp/impl/AuthorizationControllerTest.java | 2 +-
9 files changed, 405 insertions(+), 27 deletions(-)
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeSimpleOutboundResponseMessageContext.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeSimpleOutboundResponseMessageContext.java
new file mode 100644
index 0000000..9c9346a
--- /dev/null
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeSimpleOutboundResponseMessageContext.java
@@ -0,0 +1,46 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.messaging.context.MessageContext;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import net.shibboleth.idp.profile.AbstractProfileAction;
+
+/**
+ * Action that adds an outbound {@link MessageContext} to the outbound message context inside
+ * the {@link ProfileRequestContext}.
+ *
+ * @event {@link org.opensaml.profile.action.EventIds#PROCEED_EVENT_ID}
+ */
+public class InitializeSimpleOutboundResponseMessageContext extends AbstractProfileAction {
+
+ /** Class logger. */
+ @Nonnull
+ private final Logger log = LoggerFactory.getLogger(InitializeSimpleOutboundResponseMessageContext.class);
+
+ @Override
+ protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+ profileRequestContext.setOutboundMessageContext(new MessageContext());
+ log.debug("{} Initialized outbound message context", getLogPrefix());
+ }
+}
\ No newline at end of file
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeUnverifiedRelyingPartyContext.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeUnverifiedRelyingPartyContext.java
new file mode 100644
index 0000000..cc2b7c4
--- /dev/null
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeUnverifiedRelyingPartyContext.java
@@ -0,0 +1,84 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
+
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.messaging.context.navigate.ChildContextLookup;
+import org.opensaml.profile.action.ActionSupport;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import net.shibboleth.idp.profile.AbstractProfileAction;
+import net.shibboleth.idp.profile.IdPEventIds;
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.utilities.java.support.component.ComponentSupport;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+
+/**
+ * Action that adds an unverified {@link RelyingPartyContext} to the current {@link ProfileRequestContext} tree via a creation
+ * function.
+ *
+ * @event {@link IdPEventIds#INVALID_RELYING_PARTY_CTX}
+ * @post ProfileRequestContext.getSubcontext(RelyingPartyContext.class) != null
+ * WITHOUT relying party id set.
+ */
+public class InitializeUnverifiedRelyingPartyContext extends AbstractProfileAction {
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(InitializeUnverifiedRelyingPartyContext.class);
+
+ /** Strategy that will return or create a {@link RelyingPartyContext}. */
+ @Nonnull private Function<ProfileRequestContext,RelyingPartyContext> relyingPartyContextCreationStrategy;
+
+ /** Constructor. */
+ public InitializeUnverifiedRelyingPartyContext() {
+ relyingPartyContextCreationStrategy = new ChildContextLookup<>(RelyingPartyContext.class, true);
+ }
+
+ /**
+ * Set the strategy used to return or create the {@link RelyingPartyContext}
+ * .
+ * @param strategy
+ * creation strategy
+ */
+ public void setRelyingPartyContextCreationStrategy(
+ @Nonnull final Function<ProfileRequestContext, RelyingPartyContext> strategy) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ relyingPartyContextCreationStrategy = Constraint.isNotNull(strategy,
+ "RelyingPartyContext creation strategy cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+
+ final RelyingPartyContext rpContext = relyingPartyContextCreationStrategy.apply(profileRequestContext);
+ if (rpContext == null) {
+ log.error("{} Unable to locate or create RelyingPartyContext", getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_RELYING_PARTY_CTX);
+ return;
+ }
+ log.debug("{} new RelyingPartyContext successfully created and attached", getLogPrefix());
+ }
+
+}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/keyset/impl/RelyingPartyCredentialsToPublishLookupStrategy.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/keyset/impl/RelyingPartyCredentialsToPublishLookupStrategy.java
new file mode 100644
index 0000000..5fee557
--- /dev/null
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/keyset/impl/RelyingPartyCredentialsToPublishLookupStrategy.java
@@ -0,0 +1,63 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.authn.oidc.rp.keyset.impl;
+
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.security.credential.Credential;
+
+import net.shibboleth.oidc.profile.config.OIDCSecurityConfiguration;
+import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
+import net.shibboleth.utilities.java.support.resolver.ResolverException;
+
+/**
+ * Strategy to locate the set of credentials the RP will publish in its KeySet document.
+ */
+public class RelyingPartyCredentialsToPublishLookupStrategy implements Function<OIDCSecurityConfiguration, List<Credential>>{
+
+ @Override
+ @Nonnull public List<Credential> apply(@Nullable final OIDCSecurityConfiguration config) {
+
+ if (config == null) {
+ return Collections.emptyList();
+ }
+ final List<Credential> credentials = new ArrayList<>();
+
+ if (config.getJwtSignatureSigningConfiguration() != null) {
+ credentials.addAll(config.getJwtSignatureSigningConfiguration().getSigningCredentials());
+ }
+ if (config.getJwtDecryptionConfiguration() != null) {
+ try {
+ final Iterable<Credential> resolvedCreds =
+ config.getJwtDecryptionConfiguration().getKEKCredentialResolver().resolve(new CriteriaSet());
+ resolvedCreds.forEach(credentials::add);
+ } catch (final ResolverException e) {
+ e.printStackTrace();
+ }
+
+ }
+ return credentials;
+ }
+
+}
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 2e2c4e3..0b6cc94 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -542,6 +542,24 @@
</property>
</bean>
+
+ <!-- KeySet profile audit config -->
+
+
+ <bean id="shibboleth.authn.oidc.rp.DefaultPostKeySetResponsePopulateAuditContext" lazy-init="true"
+ class="org.springframework.beans.factory.config.MapFactoryBean">
+ <property name="sourceMap">
+ <map>
+ <entry>
+ <key>
+ <util:constant
+ static-field="net.shibboleth.oidc.profile.audit.AuditFields.OUTBOUND_MESSAGE_CLASS" />
+ </key>
+ <bean class="net.shibboleth.oidc.profile.audit.impl.OutboundMessageClassLookupFunction" />
+ </entry>
+ </map>
+ </property>
+ </bean>
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
index 2bb1f15..21a8916 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
@@ -247,12 +247,12 @@
</util:list>
<bean id="HTTPRedirectAuthnRequestEncoder"
- class="net.shibboleth.oidc.profile.encoder.impl.HTTPRedirectAuthnRequestEncoder" init-method=""
+ class="net.shibboleth.oidc.profile.encoding.impl.HTTPRedirectAuthnRequestEncoder" init-method=""
scope="prototype" p:httpServletResponse-ref="shibboleth.authn.oidc.rp.internal.HttpServletResponse"
p:authorizationParamsAreValidPredicate="#{getObject('shibboleth.authn.oidc.rp.AuthzParamsValidPredicate')}" />
<bean id="HTTPPostAuthnRequestEncoder"
- class="net.shibboleth.oidc.profile.encoder.impl.HTTPPostAuthnRequestEncoder" init-method="" scope="prototype"
+ class="net.shibboleth.oidc.profile.encoding.impl.HTTPPostAuthnRequestEncoder" init-method="" scope="prototype"
p:velocityEngine-ref="shibboleth.VelocityEngine" p:httpServletResponse-ref="shibboleth.authn.oidc.rp.internal.HttpServletResponse"
p:authorizationParamsAreValidPredicate="#{getObject('shibboleth.authn.oidc.rp.AuthzParamsValidPredicate')}" />
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/rp/keyset/keyset-beans.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/rp/keyset/keyset-beans.xml
new file mode 100644
index 0000000..eea7339
--- /dev/null
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/rp/keyset/keyset-beans.xml
@@ -0,0 +1,90 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans" xmlns:c="http://www.springframework.org/schema/c"
+ xmlns:context="http://www.springframework.org/schema/context" xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:util="http://www.springframework.org/schema/util" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+ default-init-method="initialize" default-destroy-method="destroy">
+
+
+ <bean class="org.springframework.context.support.PropertySourcesPlaceholderConfigurer" p:placeholderPrefix="%{"
+ p:placeholderSuffix="}" />
+
+ <bean class="net.shibboleth.ext.spring.config.IdentifiableBeanPostProcessor" />
+ <bean class="net.shibboleth.idp.profile.impl.ProfileActionBeanPostProcessor" />
+
+ <bean id="shibboleth.authn.oidc.rp.profileId" class="java.lang.String"
+ c:_0="#{T(net.shibboleth.oidc.profile.config.OIDCPublishKeySetConfiguration).PROFILE_ID}" />
+
+ <bean id="shibboleth.authn.oidc.rp.loggingId" class="java.lang.String" c:_0="%{idp.service.logging.oidckeyset:OIDC.RP.Keyset}" />
+
+ <bean id="InitializeProfileRequestContext"
+ class="net.shibboleth.idp.profile.impl.InitializeProfileRequestContext" scope="prototype"
+ p:profileId-ref="shibboleth.authn.oidc.rp.profileId"
+ p:legacyProfileId="#{getObject('hibboleth.authn.oidc.rp.legacyProfileId')}"
+ p:loggingId-ref="shibboleth.authn.oidc.rp.loggingId"
+ p:browserProfile="false" />
+
+ <bean id="InitializeOutboundMessageContext"
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.InitializeSimpleOutboundResponseMessageContext" scope="prototype" />
+
+ <bean id="InitializeRelyingPartyContext"
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.InitializeUnverifiedRelyingPartyContext" scope="prototype" />
+
+ <bean id="SelectRelyingPartyConfiguration"
+ class="net.shibboleth.idp.profile.impl.SelectRelyingPartyConfiguration" scope="prototype"
+ p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
+
+ <bean id="SelectProfileConfiguration" class="net.shibboleth.idp.profile.impl.SelectProfileConfiguration"
+ scope="prototype" />
+
+ <bean id="FormOutboundMessage"
+ class="net.shibboleth.oidc.profile.impl.FormOutboundKeySetResponseMessage" scope="prototype"
+ p:credentialsToPublishLookupStrategy="#{getObject('shibboleth.authn.oidc.rp.keyset.KeySetCredentialsToPublishLookupStrategy') ?:
+ getObject('shibboleth.authn.oidc.rp.keyset.DefaultKeySetCredentialsToPublishLookupStrategy')}"/>
+
+
+ <bean id="shibboleth.authn.oidc.rp.keyset.DefaultKeySetCredentialsToPublishLookupStrategy"
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.keyset.impl.RelyingPartyCredentialsToPublishLookupStrategy"/>
+
+ <bean id="EncodeMessage" class="org.opensaml.profile.action.impl.EncodeMessage" scope="prototype"
+ p:messageEncoderFactory-ref="shibboleth.authn.oidc.rp.keyset.messageEncoderFactory"
+ p:httpServletResponse-ref="shibboleth.HttpServletResponse" />
+
+ <bean id="shibboleth.authn.oidc.rp.keyset.messageEncoderFactory"
+ class="net.shibboleth.oidc.profile.encoding.impl.OIDCResponseEncoderFactory"
+ p:messageEncoder-ref="shibboleth.authn.oidc.rp.keyset.nimbusEncoder" scope="prototype" />
+
+ <bean id="shibboleth.authn.oidc.rp.keyset.nimbusEncoder" class="net.shibboleth.oidc.profile.encoding.impl.SimpleNimbusResponseEncoder"
+ scope="prototype" p:httpServletResponse-ref="shibboleth.HttpServletResponse" init-method="" />
+
+ <bean id="RecordResponseComplete" class="net.shibboleth.idp.profile.impl.RecordResponseComplete"
+ scope="prototype" />
+
+ <bean id="PostKeySetResponsePopulateAuditContext" parent="shibboleth.AbstractPopulateAuditContext"
+ p:fieldExtractors="#{getObject('shibboleth.authn.oidc.rp.PostKeySetResponsePopulateAuditContext') ?: getObject('shibboleth.authn.oidc.rp.DefaultPostKeySetResponsePopulateAuditContext')}" />
+
+ <bean id="WriteAuditLog" class="net.shibboleth.idp.profile.audit.impl.WriteAuditLog" scope="prototype"
+ p:formattingMap-ref="shibboleth.AuditFormattingMap"
+ p:dateTimeFormat="#{getObject('shibboleth.AuditDateTimeFormat')}"
+ p:useDefaultTimeZone="#{getObject('shibboleth.AuditDefaultTimeZone') ?: false}"
+ p:httpServletRequest-ref="shibboleth.HttpServletRequest" />
+
+ <bean id="BuildErrorResponseFromEvent"
+ class="net.shibboleth.oidc.profile.impl.BuildJSONErrorResponseFromEvent" scope="prototype"
+ p:defaultStatusCode="500" p:defaultCode="server_error"
+ p:httpServletResponse-ref="shibboleth.HttpServletResponse">
+ <property name="eventContextLookupStrategy">
+ <bean class="net.shibboleth.idp.profile.context.navigate.WebFlowCurrentEventLookupFunction" />
+ </property>
+ </bean>
+
+ <bean id="LogEvent" class="org.opensaml.profile.action.impl.LogEvent" scope="prototype"
+ p:suppressedEvents="#{getObject('shibboleth.SuppressedEvents') ?: getObject('shibboleth.DefaultSuppressedEvents')}">
+ <property name="eventContextLookupStrategy">
+ <bean class="net.shibboleth.idp.profile.context.navigate.WebFlowCurrentEventLookupFunction" />
+ </property>
+ </bean>
+
+</beans>
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/rp/keyset/keyset-flow.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/rp/keyset/keyset-flow.xml
new file mode 100644
index 0000000..8a80703
--- /dev/null
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/rp/keyset/keyset-flow.xml
@@ -0,0 +1,50 @@
+<flow xmlns="http://www.springframework.org/schema/webflow"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/webflow http://www.springframework.org/schema/webflow/spring-webflow.xsd">
+
+ <action-state id="InitializeMandatoryContexts">
+ <evaluate expression="InitializeProfileRequestContext" />
+ <evaluate expression="InitializeOutboundMessageContext" />
+ <evaluate expression="InitializeRelyingPartyContext" />
+ <evaluate expression="SelectRelyingPartyConfiguration" />
+ <evaluate expression="SelectProfileConfiguration" />
+ <evaluate expression="'proceed'" />
+ <transition on="proceed" to="BuildResponseMessage" />
+ </action-state>
+
+ <action-state id="BuildResponseMessage">
+ <evaluate expression="FormOutboundMessage" />
+ <evaluate expression="'proceed'" />
+ <transition on="proceed" to="CommitResponse" />
+ </action-state>
+
+ <action-state id="HandleError">
+ <on-entry>
+ <evaluate
+ expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.profile.context.SpringRequestContext), true).setRequestContext(flowRequestContext)" />
+ <evaluate expression="LogEvent" />
+ </on-entry>
+ <evaluate expression="BuildErrorResponseFromEvent" />
+ <evaluate expression="'proceed'" />
+ <transition on="proceed" to="CommitResponse" />
+ </action-state>
+
+
+ <end-state id="CommitResponse">
+ <on-entry>
+ <evaluate expression="EncodeMessage" />
+ <evaluate expression="PostKeySetResponsePopulateAuditContext" />
+ <evaluate expression="WriteAuditLog" />
+ <evaluate expression="RecordResponseComplete" />
+ </on-entry>
+ </end-state>
+
+ <!-- all unhandled non proceed results are turned into errors -->
+ <global-transitions>
+ <transition on-exception="java.lang.RuntimeException" to="LogRuntimeException" />
+ <transition on="#{!'proceed'.equals(currentEvent.id)}" to="HandleError" />
+ </global-transitions>
+
+ <bean-import resource="keyset-beans.xml" />
+
+</flow>
\ No newline at end of file
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index 55f25fb..edbfab8 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -10,10 +10,33 @@
default-init-method="initialize" default-destroy-method="destroy">
- <!-- This was all moved to commons -->
+ <!--
+ Security Configuration Defaults. These settings establish the default security configurations for
+ signatures and loads the default credentials used.
+ -->
+ <bean id="shibboleth.authn.oidc.rp.BasicSignatureValidationConfiguration" abstract="true"
+ class="net.shibboleth.oidc.security.impl.BasicJWTSignatureValidationConfiguration"
+ p:includedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.IncludedSignatureAlgorithms')}"
+ p:excludedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.ExcludedSignatureAlgorithms')}" />
- <!-- TODO I moved this back for the time being -->
+ <bean id="shibboleth.authn.oidc.rp.BasicSignatureSigningConfiguration" abstract="true"
+ class="net.shibboleth.oidc.security.impl.BasicJWTSignatureSigningConfiguration"
+ p:includedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.IncludedSignatureAlgorithms')}"
+ p:excludedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.ExcludedSignatureAlgorithms')}" />
+ <bean id="shibboleth.authn.oidc.rp.BasicEncryptionConfiguration" abstract="true"
+ class="net.shibboleth.oidc.security.impl.BasicJWTEncryptionConfiguration"
+ p:includedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.IncludedEncryptionAlgorithms')}"
+ p:excludedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.ExcludedEncryptionAlgorithms')}" />
+
+ <bean id="shibboleth.authn.oidc.rp.BasicDecryptionConfiguration" abstract="true"
+ class="net.shibboleth.oidc.security.impl.BasicJWTDecryptionConfiguration"
+ p:includedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.IncludedEncryptionAlgorithms')}"
+ p:excludedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.ExcludedEncryptionAlgorithms')}" />
+
+
+
+ <!-- This was all moved to commons. TODO I moved this back for the time being -->
<bean id="AbstractOIDCProfile" abstract="true"
p:securityConfiguration-ref="%{idp.security.authn.oidc.rp.config:shibboleth.authn.oidc.rp.DefaultSecurityConfiguration}" />
@@ -63,30 +86,34 @@
</property>
</bean>
- <!--
- Security Configuration Defaults. These settings establish the default security configurations for
- signatures and loads the default credentials used.
- -->
- <bean id="shibboleth.authn.oidc.rp.BasicSignatureValidationConfiguration" abstract="true"
- class="net.shibboleth.oidc.security.impl.BasicJWTSignatureValidationConfiguration"
- p:includedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.IncludedSignatureAlgorithms')}"
- p:excludedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.ExcludedSignatureAlgorithms')}" />
+ <!-- Keyset profile -->
+ <bean id="OIDC.Keyset" parent="AbstractOIDCProfile" lazy-init="true"
+ class="net.shibboleth.oidc.profile.config.OIDCPublishKeySetConfiguration"
+ p:securityConfiguration-ref="shibboleth.authn.oidc.rp.PublishKeySetSecurityConfiguration" />
+
+ <!-- Configuration for publishing key set. -->
+ <bean id="shibboleth.authn.oidc.rp.PublishKeySetSecurityConfiguration"
+ class="net.shibboleth.oidc.profile.config.OIDCSecurityConfiguration">
+ <property name="jwtSignatureSigningConfiguration">
+ <ref bean="shibboleth.authn.oidc.rp.PublishKeySetSigningConfiguration" />
+ </property>
+ <property name="jwtDecryptionConfiguration">
+ <ref bean="shibboleth.authn.oidc.rp.PublishKeySetDecryptionConfiguration" />
+ </property>
+ </bean>
- <bean id="shibboleth.authn.oidc.rp.BasicSignatureSigningConfiguration" abstract="true"
- class="net.shibboleth.oidc.security.impl.BasicJWTSignatureSigningConfiguration"
- p:includedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.IncludedSignatureAlgorithms')}"
- p:excludedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.ExcludedSignatureAlgorithms')}" />
+ <bean id="shibboleth.authn.oidc.rp.PublishKeySetSigningConfiguration" parent="shibboleth.authn.oidc.rp.BasicSignatureSigningConfiguration"
+ p:signingCredentials="#{getObject('shibboleth.authn.oidc.rp.SigningCredentialsToPublish') ?: getObject('shibboleth.authn.oidc.rp.SigningCredentials')}"/>
- <bean id="shibboleth.authn.oidc.rp.BasicEncryptionConfiguration" abstract="true"
- class="net.shibboleth.oidc.security.impl.BasicJWTEncryptionConfiguration"
- p:includedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.IncludedEncryptionAlgorithms')}"
- p:excludedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.ExcludedEncryptionAlgorithms')}" />
-
- <bean id="shibboleth.authn.oidc.rp.BasicDecryptionConfiguration" abstract="true"
- class="net.shibboleth.oidc.security.impl.BasicJWTDecryptionConfiguration"
- p:includedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.IncludedEncryptionAlgorithms')}"
- p:excludedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.ExcludedEncryptionAlgorithms')}" />
-
+ <!-- This is a simplified version of the decryption config to access the public encryption key -->
+ <bean id="shibboleth.authn.oidc.rp.PublishKeySetDecryptionConfiguration" parent="shibboleth.authn.oidc.rp.BasicDecryptionConfiguration">
+ <property name="KEKCredentialResolver">
+ <bean id="defaultOIDCRPKeyDecryptionCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ReturnAllCollectionJOSEObjectCredentialResolver"
+ c:credentials="#{getObject('shibboleth.authn.oidc.rp.EncryptionCredentialsToPublish') ?: getObject('shibboleth.authn.oidc.rp.DefaultKeyEncryptionCredentials')}"/>
+ </property>
+ </bean>
+
<bean id="shibboleth.authn.oidc.rp.DefaultSecurityConfiguration"
class="net.shibboleth.oidc.profile.config.OIDCSecurityConfiguration">
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthorizationControllerTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthorizationControllerTest.java
index 139c974..0c8b6a3 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthorizationControllerTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthorizationControllerTest.java
@@ -101,7 +101,7 @@ import net.shibboleth.idp.ui.context.RelyingPartyUIContext;
import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration.OIDCHttpRequestMethod;
import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
import net.shibboleth.oidc.profile.decoding.OIDCMessageDecoder;
-import net.shibboleth.oidc.profile.encoder.impl.AbstractOIDCMessageEncoder;
+import net.shibboleth.oidc.profile.encoding.impl.AbstractOIDCMessageEncoder;
import net.shibboleth.oidc.security.JWTEncryptionParameters;
import net.shibboleth.oidc.security.JWTSignatureSigningParameters;
import net.shibboleth.oidc.security.context.JWTSecurityParametersContext;
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list