[java-idp-plugin-oidc-rp] branch main updated: Move RP config to commons. Fix integration tests
Phil Smart
philip.smart at jisc.ac.uk
Wed Oct 12 14:46:36 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=07e8fcecfa170a8b47166b01af8e21e5fd3ea955
The following commit(s) were added to refs/heads/main by this push:
new 07e8fce Move RP config to commons. Fix integration tests
07e8fce is described below
commit 07e8fcecfa170a8b47166b01af8e21e5fd3ea955
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Oct 12 15:46:31 2022 +0100
Move RP config to commons. Fix integration tests
---
.../idp/service/relying-party/postconfig.xml | 272 +--------------------
.../plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java | 64 ++---
.../idp/service/relying-party/postconfig.xml | 22 +-
.../resources/conf/test-relying-party-system.xml | 7 +-
4 files changed, 48 insertions(+), 317 deletions(-)
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index 296508f..0f078cc 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -9,277 +9,7 @@
default-init-method="initialize" default-destroy-method="destroy">
- <!-- OIDC RP Profile Configurations. -->
-
- <!-- FIXME This will NEED a new ID and possibly class. If not, the OP plugin and RP plugin can not be installed together -->
- <bean id="AbstractOIDCProfile" abstract="true"
- p:securityConfiguration-ref="%{idp.security.authn.oidc.rp.config:shibboleth.authn.oidc.rp.DefaultSecurityConfiguration}" />
-
- <bean id="AbstractOIDCSSOProfile" parent="AbstractOIDCProfile" abstract="true"
- p:issuer-ref="issuer"
- p:tokenEndpointAuthMethods="%{idp.authn.oidc.rp.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}"/>
-
- <bean id="OIDC.SSO" parent="AbstractOIDCSSOProfile" lazy-init="true"
- class="net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration"
- p:httpRequestMethod="%{idp.authn.oidc.rp.httpRequestMethod:GET}"
- p:clientId="#{%{idp.authn.oidc.rp.discoveryRequired:false} == true ? null : '%{idp.authn.oidc.rp.client.clientId:}'}"
- p:clientCredential="#{%{idp.authn.oidc.rp.discoveryRequired:false} == true ? {null} : getObject('shibboleth.authn.oidc.rp.DefaultCredential')}"
- p:tokenEndpointAuthMethods="%{idp.authn.oidc.rp.clientAuthenticationMethod:client_secret_basic}"
- p:responseMode="%{idp.authn.oidc.rp.responseMode:#{null}}"
- p:retrieveUserInfoEndpointClaims="%{idp.authn.oidc.rp.useUserInfoEndpoint:true}"
- p:redirectUriOverride="%{idp.authn.oidc.rp.client.redirectURL:#{null}}"
- p:encryptRequestObject="%{idp.authn.oidc.rp.client.requestobject.encrypted:false}"
- p:signRequestObject="%{idp.authn.oidc.rp.client.requestobject.signed:true}"
- p:useRequestObject="%{idp.authn.oidc.rp.client.requestobject.supported:false}"
- p:scopes="%{idp.authn.oidc.rp.scopes:#{null}}">
- <property name="forceAuthnPredicate">
- <bean class="net.shibboleth.idp.saml.profile.config.logic.ProxyAwareForceAuthnPredicate" />
- </property>
- <property name="defaultAuthenticationMethodsLookupStrategy">
- <bean
- class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassRequestLookupFunction"
- p:mappings="#{getObject('shibboleth.authn.oidc.rp.PrincipalProxyRequestMappings')}" />
- </property>
- <property name="authenticationContextClassReferenceTranslationStrategyLookupStrategy">
- <bean
- class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction$LookupFunctionWrapper">
- <constructor-arg>
- <bean class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction"
- c:mappings="#{getObject('shibboleth.authn.oidc.rp.PrincipalProxyResponseMappings')}"/>
- </constructor-arg>
- </bean>
- </property>
- <property name="authenticationMethodsReferencesTranslationStrategyLookupStrategy">
- <bean
- class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction$LookupFunctionWrapper">
- <constructor-arg>
- <bean class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction"
- c:mappings="#{getObject('shibboleth.authn.oidc.rp.PrincipalProxyResponseMappings')}"/>
- </constructor-arg>
- </bean>
- </property>
- </bean>
-
-
- <!--
- Security Configuration Defaults. These settings establish the default security configurations for
- signatures and loads the default credentials used.
- -->
- <bean id="shibboleth.authn.oidc.rp.BasicSignatureValidationConfiguration" abstract="true"
- class="net.shibboleth.oidc.security.impl.BasicJWTSignatureValidationConfiguration"
- p:includedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.IncludedSignatureAlgorithms')}"
- p:excludedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.ExcludedSignatureAlgorithms')}" />
-
- <bean id="shibboleth.authn.oidc.rp.BasicSignatureSigningConfiguration" abstract="true"
- class="net.shibboleth.oidc.security.impl.BasicJWTSignatureSigningConfiguration"
- p:includedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.IncludedSignatureAlgorithms')}"
- p:excludedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.ExcludedSignatureAlgorithms')}" />
-
- <bean id="shibboleth.authn.oidc.rp.BasicEncryptionConfiguration" abstract="true"
- class="net.shibboleth.oidc.security.impl.BasicJWTEncryptionConfiguration"
- p:includedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.IncludedEncryptionAlgorithms')}"
- p:excludedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.ExcludedEncryptionAlgorithms')}" />
-
- <bean id="shibboleth.authn.oidc.rp.BasicDecryptionConfiguration" abstract="true"
- class="net.shibboleth.oidc.security.impl.BasicJWTDecryptionConfiguration"
- p:includedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.IncludedEncryptionAlgorithms')}"
- p:excludedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.ExcludedEncryptionAlgorithms')}" />
-
-
- <bean id="shibboleth.authn.oidc.rp.DefaultSecurityConfiguration"
- class="net.shibboleth.oidc.profile.config.OIDCSecurityConfiguration">
- <property name="jwtDecryptionConfiguration">
- <ref
- bean="#{'%{idp.authn.oidc.rp.idtoken.decrypt.config:shibboleth.authn.oidc.rp.DefaultJWTDecryptionConfiguration}'.trim()}" />
- </property>
- <property name="jwtSignatureValidationConfiguration">
- <ref
- bean="#{'%{idp.authn.oidc.rp.idtoken.valid.config:shibboleth.authn.oidc.rp.DefaultJWTSignatureValidationConfiguration}'.trim()}" />
- </property>
- <property name="jwtSignatureSigningConfiguration">
- <ref
- bean="#{'%{idp.authn.oidc.rp.requestobject.signing.config:shibboleth.authn.oidc.rp.DefaultJWTSigningConfiguration}'.trim()}" />
- </property>
- <property name="jwtEncryptionConfiguration">
- <ref
- bean="#{'%{idp.authn.oidc.rp.requestobject.encryption.config:shibboleth.authn.oidc.rp.DefaultJWTEncryptionConfiguration}'.trim()}" />
- </property>
- </bean>
-
- <!--
- See https://openid.net/specs/openid-connect-core-1_0.html#Encryption. But encryption is either based
- on published OP keys, or the client_secret, so we can not allow abitrarily configured keys
- -->
- <bean id="shibboleth.authn.oidc.rp.DefaultJWTEncryptionConfiguration"
- parent="shibboleth.authn.oidc.rp.BasicEncryptionConfiguration"
- p:KEKCredentialResolver-ref="defaultOIDCRPKeyEncryptionCredentialResolver"
- p:contentEncryptionKeyCredentialResolver-ref="defaultOIDCRPContentEncryptionKeyCredentialResolver">
- <property name="keyTransportEncryptionAlgorithms">
- <list>
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_RSA_1_5" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_RSA_OAEP" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_RSA_OAEP_256" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_128_KW" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_192_KW" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_256_KW" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_128_GCM_KW" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_192_GCM_KW" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_256_GCM_KW" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_ECDH_ES" />
- </list>
- </property>
- <property name="dataEncryptionAlgorithms">
- <list>
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A128GCM" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A192GCM" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A256GCM" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A128CBC_HS256" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A192CBC_HS384" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A256CBC_HS512" />
- </list>
- </property>
- </bean>
-
- <bean id="shibboleth.authn.oidc.rp.DefaultJWTSigningConfiguration"
- parent="shibboleth.authn.oidc.rp.BasicSignatureSigningConfiguration"
- p:signingCredentials-ref="shibboleth.authn.oidc.rp.SigningCredentials">
- <property name="signatureAlgorithms">
- <list>
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_RS_256" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_RS_384" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_RS_512" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_HS_256" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_HS_384" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_HS_512" />
- </list>
- </property>
- </bean>
-
- <bean id="shibboleth.authn.oidc.rp.DefaultJWTDecryptionConfiguration"
- parent="shibboleth.authn.oidc.rp.BasicDecryptionConfiguration"
- p:KEKCredentialResolver-ref="defaultOIDCRPKeyDecryptionCredentialResolver"
- p:contentEncryptionKeyCredentialResolver-ref="defaultOIDCRPContentDecryptionKeyCredentialResolver" />
-
-
- <bean id="shibboleth.authn.oidc.rp.SigningCredentials"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.config.CredentialsListFactory"
- c:_0="#{getObject('shibboleth.authn.oidc.rp.DefaultSigningCredentials')}" />
-
-
- <!--
- A resolver to public/private key encryption keys global to the RP
- -->
- <bean id="defaultOIDCRPKeyDecryptionCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
- <constructor-arg>
- <list>
- <bean class="net.shibboleth.oidc.security.credential.impl.LocalJOSEObjectCredentialResolver">
- <constructor-arg name="localCredentialResolver">
- <bean
- class="net.shibboleth.oidc.security.credential.impl.CollectionJOSEObjectCredentialResolver"
- c:credentials-ref="shibboleth.authn.oidc.rp.DefaultKeyEncryptionCredentials" />
- </constructor-arg>
- </bean>
- <bean id="CriterionCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.CriterionCredentialResolver" />
- </list>
- </constructor-arg>
- </bean>
-
- <!--
- A resolver to resolve a pre-shared Direct Encryption key e.g. a pairwise client_secret from the input criterion
- from which to derive the decryption key.
- -->
- <bean id="defaultOIDCRPContentDecryptionKeyCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
- <constructor-arg>
- <list>
- <bean id="CriterionCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.CriterionCredentialResolver" />
- </list>
- </constructor-arg>
- </bean>
-
- <!-- A resolver to public key encryption in the OPs metadata alongside the client_secret for key wrapping -->
- <bean id="defaultOIDCRPKeyEncryptionCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
- <constructor-arg>
- <list>
- <bean id="OIDCProviderMetadataCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.ProviderMetadataCredentialResolver"
- p:remoteJwkSetCache-ref="shibboleth.authn.oidc.rp.RemoteJwkSetCache"
- p:keyFetchInterval="%{idp.authn.oidc.rp.provider.keyfetch.interval:PT30M}" />
- <bean id="CriterionCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.CriterionCredentialResolver" />
- </list>
- </constructor-arg>
- </bean>
-
- <!--
- A resolver to resolve pre-shared Direct Encryption or Key Wrapping credentials based on the
- client_secret in the input criterion. Returns the raw value, even though the key to use
- is a derivative of this key.
- -->
- <bean id="defaultOIDCRPContentEncryptionKeyCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
- <constructor-arg>
- <list>
- <bean id="CriterionCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.CriterionCredentialResolver" />
- </list>
- </constructor-arg>
- </bean>
-
- <bean id="shibboleth.authn.oidc.rp.DefaultJWTSignatureValidationConfiguration"
- parent="shibboleth.authn.oidc.rp.BasicSignatureValidationConfiguration"
- p:signatureTrustEngine-ref="ExplicitKeySignedJWTTrustEngine">
- </bean>
-
- <!-- A resolver for resolving trusted credentials to match against those resolved from the JWT -->
- <bean id="defaultSignedJWTTrustedCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
- <constructor-arg>
- <list>
- <bean id="OIDCProviderMetadataCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.ProviderMetadataCredentialResolver"
- p:remoteJwkSetCache-ref="shibboleth.authn.oidc.rp.RemoteJwkSetCache"
- p:keyFetchInterval="%{idp.authn.oidc.rp.provider.keyfetch.interval:PT30M}"/>
- <bean id="CriterionCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.CriterionCredentialResolver" />
- </list>
- </constructor-arg>
- </bean>
-
- <!-- A resolver for resolving 'untrusted' credentials out of the JOSE header of JWTs -->
- <bean id="defaultSignedJWTJOSEHeaderCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver" />
-
- <bean id="ExplicitKeySignedJWTTrustEngine"
- class="net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine"
- c:resolver-ref="defaultSignedJWTTrustedCredentialResolver"
- c:JOSEObjectResolver-ref="defaultSignedJWTJOSEHeaderCredentialResolver" />
+ <!-- This was all moved to commons -->
</beans>
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java
index a995aca..0f647da 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java
@@ -112,6 +112,8 @@ import okhttp3.tls.HeldCertificate;
* in the various XML configuration files. Any test which tests flow execution from the authentication
* request controller will need to setup all required contexts programatically. </p>
*
+ * <p>Note, the profile configuration which normal exists in oidc-commons i.e.
+ * inside the relying-party/postconfig.xml, is in the test resources tree</p>
* */
public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
@@ -321,7 +323,7 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
loadBeanDefinitionsFromXmlFile(builderContext,
new ClassPathResource("conf/test-relyingparty-resolver-service.xml"),
Map.of("idp.authn.oidc.rp.client.clientId", CLIENT_ID,
- "idp.authn.oidc.rp.client.redirectURL", REDIRECT_URI_OVERRIDE));
+ "idp.authn.oidc.rp.client.redirectURI", REDIRECT_URI_OVERRIDE));
loadBeanDefinitionsFromXmlFile(builderContext,
new ClassPathResource("conf/additional-system-beans.xml"), null);
@@ -474,7 +476,7 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
final Map<String,String> mockProperties = Map.of(
"idp.service.clientinfo.failFast","false",
"idp.entityID", "http://idp.example.com/",
- "idp.authn.oidc.rp.proxyIssuer",OP_ISSUER_ID);
+ "idp.authn.oidc.rp.provider.proxyIssuer",OP_ISSUER_ID);
setMockProperties(mockProperties);
@@ -494,10 +496,11 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
.put("opensamlProfileRequestContext",
buildProfileRequestContext("authn/OIDCRelyingParty",false,true));
updateFlowExecution(flowExecution);
- flowExecution.start(inputMap, externalContext);
- assertCurrentStateEquals("AuthnRequest");
+ flowExecution.start(inputMap, externalContext);
mockOPServer.shutdown();
+
+ assertCurrentStateEquals("AuthnRequest");
}
/**
@@ -514,7 +517,7 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
final Map<String,String> mockProperties = Map.of(
"idp.service.clientinfo.failFast","false",
"idp.entityID", "http://idp.example.com/",
- "idp.authn.oidc.rp.proxyIssuer",OP_ISSUER_ID_REQUESTOBJECT_TRUE);
+ "idp.authn.oidc.rp.provider.proxyIssuer",OP_ISSUER_ID_REQUESTOBJECT_TRUE);
setMockProperties(mockProperties);
@@ -534,10 +537,11 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
final FlowExecution flowExecution = getFlowExecutionFactory().createFlowExecution(getFlowDefinition());
flowExecution.getConversationScope().put("opensamlProfileRequestContext",prc);
updateFlowExecution(flowExecution);
- flowExecution.start(inputMap, externalContext);
- assertCurrentStateEquals("AuthnRequest");
+ flowExecution.start(inputMap, externalContext);
mockOPServer.shutdown();
+
+ assertCurrentStateEquals("AuthnRequest");
}
/**
@@ -555,7 +559,7 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
final Map<String,String> mockProperties = Map.of(
"idp.service.clientinfo.failFast","false",
"idp.entityID", "http://idp.example.com/",
- "idp.authn.oidc.rp.proxyIssuer",OP_ISSUER_ID_REQUESTOBJECT_TRUE_ENCRYPT);
+ "idp.authn.oidc.rp.provider.proxyIssuer",OP_ISSUER_ID_REQUESTOBJECT_TRUE_ENCRYPT);
setMockProperties(mockProperties);
@@ -580,10 +584,12 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
final FlowExecution flowExecution = getFlowExecutionFactory().createFlowExecution(getFlowDefinition());
flowExecution.getConversationScope().put("opensamlProfileRequestContext",prc);
updateFlowExecution(flowExecution);
- flowExecution.start(inputMap, externalContext);
- assertCurrentStateEquals("AuthnRequest");
+ flowExecution.start(inputMap, externalContext);
mockOPServer.shutdown();
+
+ assertCurrentStateEquals("AuthnRequest");
+
}
/**
@@ -600,7 +606,7 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
final Map<String,String> mockProperties = Map.of(
"idp.service.clientinfo.failFast","false",
"idp.entityID", "http://idp.example.com/",
- "idp.authn.oidc.rp.proxyIssuer",OP_ISSUER_ID_REQUESTOBJECT_TRUE_RSA256_SIG);
+ "idp.authn.oidc.rp.provider.proxyIssuer",OP_ISSUER_ID_REQUESTOBJECT_TRUE_RSA256_SIG);
setMockProperties(mockProperties);
@@ -620,10 +626,11 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
final FlowExecution flowExecution = getFlowExecutionFactory().createFlowExecution(getFlowDefinition());
flowExecution.getConversationScope().put("opensamlProfileRequestContext",prc);
updateFlowExecution(flowExecution);
- flowExecution.start(inputMap, externalContext);
- assertCurrentStateEquals("AuthnRequest");
+ flowExecution.start(inputMap, externalContext);
mockOPServer.shutdown();
+
+ assertCurrentStateEquals("AuthnRequest");
}
@Test
@@ -635,7 +642,7 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
final Map<String,String> mockProperties = Map.of(
"idp.service.clientinfo.failFast","false",
"idp.entityID", "http://idp.example.com/",
- "idp.authn.oidc.rp.proxyIssuer",OP_ISSUER_ID);
+ "idp.authn.oidc.rp.provider.proxyIssuer",OP_ISSUER_ID);
setMockProperties(mockProperties);
@@ -663,9 +670,12 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
flowExecution.getConversationScope().put("opensamlProfileRequestContext", prc);
updateFlowExecution(flowExecution);
flowExecution.start(inputMap, externalContext);
- assertCurrentStateEquals("AuthnRequest");
mockOPServer.shutdown();
+
+ assertCurrentStateEquals("AuthnRequest");
+
+
}
@@ -684,7 +694,7 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
final Map<String,String> mockProperties = Map.of(
"idp.entityID", "http://idp.example.com/",
- "idp.authn.oidc.rp.proxyIssuer",OP_ISSUER_ID);
+ "idp.authn.oidc.rp.provider.proxyIssuer",OP_ISSUER_ID);
setMockProperties(mockProperties);
@@ -716,9 +726,7 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
mockOPServer.shutdown();
assertStandardSuccessConditions(prc);
-
- mockOPServer.shutdown();
-
+
}
/**
@@ -736,7 +744,7 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
final Map<String,String> mockProperties = Map.of(
"idp.entityID", "http://idp.example.com/",
- "idp.authn.oidc.rp.proxyIssuer",OP_ISSUER_ID);
+ "idp.authn.oidc.rp.provider.proxyIssuer",OP_ISSUER_ID);
setMockProperties(mockProperties);
@@ -771,8 +779,7 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
assertFlowExecutionEnded();
assertNotNull(prc.getSubcontext(AuthenticationContext.class));
assertNull(prc.getSubcontext(SubjectCanonicalizationContext.class));
-
- mockOPServer.shutdown();
+
}
@@ -834,7 +841,7 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
final Map<String,String> mockProperties = Map.of(
"idp.service.clientinfo.failFast","false",
"idp.entityID", "http://idp.example.com/",
- "idp.authn.oidc.rp.proxyIssuer",OP_ISSUER_ID);
+ "idp.authn.oidc.rp.provider.proxyIssuer",OP_ISSUER_ID);
setMockProperties(mockProperties);
@@ -957,7 +964,7 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
final Map<String,String> mockProperties = Map.of(
"idp.service.clientinfo.failFast","false",
"idp.entityID", "http://idp.example.com/",
- "idp.authn.oidc.rp.proxyIssuer",OP_ISSUER_ID);
+ "idp.authn.oidc.rp.provider.proxyIssuer",OP_ISSUER_ID);
setMockProperties(mockProperties);
@@ -1052,7 +1059,7 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
final Map<String,String> mockProperties = Map.of(
"idp.service.clientinfo.failFast","false",
"idp.entityID", "http://idp.example.com/",
- "idp.authn.oidc.rp.proxyIssuer",OP_ISSUER_ID);
+ "idp.authn.oidc.rp.provider.proxyIssuer",OP_ISSUER_ID);
setMockProperties(mockProperties);
@@ -1235,7 +1242,7 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
final Map<String,String> mockProperties = Map.of(
"idp.service.clientinfo.failFast","false",
"idp.entityID", "http://idp.example.com/",
- "idp.authn.oidc.rp.proxyIssuer",OP_ISSUER_ID);
+ "idp.authn.oidc.rp.provider.proxyIssuer",OP_ISSUER_ID);
setMockProperties(mockProperties);
@@ -1273,8 +1280,7 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
resumeFlow(externalContext);
//assert success conditions
- // will end on ValidateResponse action
- assertCurrentStateEquals("ValidateResponse");
+ assertFlowExecutionEnded();
assertNotNull(prc.getSubcontext(AuthenticationContext.class));
assertNull(prc.getSubcontext(SubjectCanonicalizationContext.class));
@@ -1296,7 +1302,7 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
final Map<String,String> mockProperties = Map.of(
"idp.entityID", "http://idp.example.com/",
- "idp.authn.oidc.rp.proxyIssuer",OP_ISSUER_ID);
+ "idp.authn.oidc.rp.provider.proxyIssuer",OP_ISSUER_ID);
setMockProperties(mockProperties);
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-rp-impl/src/test/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
similarity index 95%
copy from idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
copy to idp-oidc-rp-impl/src/test/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index 296508f..5f0fcd0 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-rp-impl/src/test/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -9,9 +9,8 @@
default-init-method="initialize" default-destroy-method="destroy">
- <!-- OIDC RP Profile Configurations. -->
+ <!-- OIDC RP and OP Profile Configurations. -->
- <!-- FIXME This will NEED a new ID and possibly class. If not, the OP plugin and RP plugin can not be installed together -->
<bean id="AbstractOIDCProfile" abstract="true"
p:securityConfiguration-ref="%{idp.security.authn.oidc.rp.config:shibboleth.authn.oidc.rp.DefaultSecurityConfiguration}" />
@@ -22,16 +21,16 @@
<bean id="OIDC.SSO" parent="AbstractOIDCSSOProfile" lazy-init="true"
class="net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration"
p:httpRequestMethod="%{idp.authn.oidc.rp.httpRequestMethod:GET}"
- p:clientId="#{%{idp.authn.oidc.rp.discoveryRequired:false} == true ? null : '%{idp.authn.oidc.rp.client.clientId:}'}"
- p:clientCredential="#{%{idp.authn.oidc.rp.discoveryRequired:false} == true ? {null} : getObject('shibboleth.authn.oidc.rp.DefaultCredential')}"
- p:tokenEndpointAuthMethods="%{idp.authn.oidc.rp.clientAuthenticationMethod:client_secret_basic}"
- p:responseMode="%{idp.authn.oidc.rp.responseMode:#{null}}"
- p:retrieveUserInfoEndpointClaims="%{idp.authn.oidc.rp.useUserInfoEndpoint:true}"
- p:redirectUriOverride="%{idp.authn.oidc.rp.client.redirectURL:#{null}}"
+ p:clientId="#{%{idp.authn.oidc.rp.provider.discoveryRequired:false} == true ? null : '%{idp.authn.oidc.rp.client.clientId:}'}"
+ p:clientCredential="#{%{idp.authn.oidc.rp.provider.discoveryRequired:false} == true ? {null} : getObject('shibboleth.authn.oidc.rp.DefaultCredential')}"
+ p:tokenEndpointAuthMethods="%{idp.authn.oidc.rp.client.authenticationMethod:client_secret_basic}"
+ p:responseMode="%{idp.authn.oidc.rp.client.responseMode:#{null}}"
+ p:retrieveUserInfoEndpointClaims="%{idp.authn.oidc.rp.client.userinfo.enabled:true}"
+ p:redirectUriOverride="%{idp.authn.oidc.rp.client.redirectURI:#{null}}"
p:encryptRequestObject="%{idp.authn.oidc.rp.client.requestobject.encrypted:false}"
p:signRequestObject="%{idp.authn.oidc.rp.client.requestobject.signed:true}"
p:useRequestObject="%{idp.authn.oidc.rp.client.requestobject.supported:false}"
- p:scopes="%{idp.authn.oidc.rp.scopes:#{null}}">
+ p:scopes="%{idp.authn.oidc.rp.client.scopes:#{null}}">
<property name="forceAuthnPredicate">
<bean class="net.shibboleth.idp.saml.profile.config.logic.ProxyAwareForceAuthnPredicate" />
</property>
@@ -59,9 +58,8 @@
</bean>
</property>
</bean>
-
- <!--
+ <!--
Security Configuration Defaults. These settings establish the default security configurations for
signatures and loads the default credentials used.
-->
@@ -280,6 +278,8 @@
class="net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine"
c:resolver-ref="defaultSignedJWTTrustedCredentialResolver"
c:JOSEObjectResolver-ref="defaultSignedJWTJOSEHeaderCredentialResolver" />
+
+
</beans>
diff --git a/idp-oidc-rp-impl/src/test/resources/conf/test-relying-party-system.xml b/idp-oidc-rp-impl/src/test/resources/conf/test-relying-party-system.xml
index fc28498..aa6c8ca 100644
--- a/idp-oidc-rp-impl/src/test/resources/conf/test-relying-party-system.xml
+++ b/idp-oidc-rp-impl/src/test/resources/conf/test-relying-party-system.xml
@@ -9,8 +9,6 @@
default-init-method="initialize" default-destroy-method="destroy">
- <!-- ***Some support beans from the internal rp configuration XML -->
-
<!-- Parent bean for RelyingParty overrides based on activation by name(s). -->
<bean id="RelyingPartyByName" abstract="true" parent="RelyingParty"
class="net.shibboleth.idp.saml.relyingparty.impl.RelyingPartyConfigurationSupport" factory-method="byName" />
@@ -20,8 +18,7 @@
<bean class="net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver"
p:unverifiedConfiguration-ref="shibboleth.UnverifiedRelyingParty"
p:defaultConfiguration-ref="shibboleth.DefaultRelyingParty"
- p:relyingPartyConfigurations-ref="shibboleth.RelyingPartyOverrides"
-
+ p:relyingPartyConfigurations-ref="shibboleth.RelyingPartyOverrides"
p:signingCredentials="#{getObject('shibboleth.SigningCredentials')}"
p:encryptionCredentials="#{getObject('shibboleth.EncryptionCredentials')}" />
@@ -46,8 +43,6 @@
</property>
</bean>
- <!-- Container for any overrides you want to add. -->
-
<util:list id="shibboleth.RelyingPartyOverrides">
<!-- This override is used in the OIDCRPFlowTest#testFlowToAuthorizationRedirect_UsingRequestObject test -->
<bean id="TestRequestObject" parent="RelyingPartyByName" c:relyingPartyIds="https://localhost:9919">
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list