[java-idp-plugin-oidc-rp] branch main updated: Revert - force only JWT UserInfo response type support
Phil Smart
philip.smart at jisc.ac.uk
Fri Oct 28 09:17:33 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=9f4c749440ad1a95580dd418f03808ecda20c137
The following commit(s) were added to refs/heads/main by this push:
new 9f4c749 Revert - force only JWT UserInfo response type support
9f4c749 is described below
commit 9f4c749440ad1a95580dd418f03808ecda20c137
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Oct 28 10:17:27 2022 +0100
Revert - force only JWT UserInfo response type support
---
.../impl/AbstractHttpOIDCAuthenticationAction.java | 2 +-
.../authn/oidc/rp/impl/UserInfoEndpointLookup.java | 64 +---------------------
.../idp/service/relying-party/postconfig.xml | 3 +-
3 files changed, 5 insertions(+), 64 deletions(-)
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractHttpOIDCAuthenticationAction.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractHttpOIDCAuthenticationAction.java
index 046d13e..d08f6ee 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractHttpOIDCAuthenticationAction.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractHttpOIDCAuthenticationAction.java
@@ -41,7 +41,7 @@ import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
/**
- * An abstract class for OIDC actions that want to make synchronous HTTP requests.
+ * An abstract class for OIDC actions that make synchronous HTTP requests.
*
* @param <T> the response type of the object returned as a result of the request.
*/
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/UserInfoEndpointLookup.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/UserInfoEndpointLookup.java
index 39bcd47..cd688a7 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/UserInfoEndpointLookup.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/UserInfoEndpointLookup.java
@@ -20,7 +20,6 @@ package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
import java.util.function.Function;
import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.action.ActionSupport;
@@ -36,10 +35,6 @@ import net.shibboleth.idp.plugin.authn.oidc.rp.OIDCRPException;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.AccessTokenResponseContext;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.UserInfoResponseContext;
import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.UserInfoResponse;
-import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.UserInfoResponse.UserInfoResponseType;
-import net.shibboleth.idp.profile.IdPEventIds;
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
@@ -61,31 +56,12 @@ public class UserInfoEndpointLookup extends AbstractHttpOIDCAuthenticationAction
@Nonnull private Function<ProfileRequestContext, UserInfoResponseContext>
userInfoResponseContextLookupStrategy;
- /** Lookup function for relying party context. */
- @Nonnull private Function<ProfileRequestContext,RelyingPartyContext> relyingPartyContextLookupStrategy;
-
- /** Applicable stashed profile configuration. */
- @Nullable private OIDCAuthorizationConfiguration profileConfiguration;
-
/** Constructor.*/
public UserInfoEndpointLookup() {
userInfoResponseContextLookupStrategy =
new ChildContextLookup<>(UserInfoResponseContext.class, true).compose(
new InboundMessageContextLookup());
-
- relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
- }
-
- /**
- * Set lookup strategy for relying party context.
- *
- * @param strategy lookup strategy
- */
- public void setRelyingPartyContextLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,RelyingPartyContext> strategy) {
- relyingPartyContextLookupStrategy =
- Constraint.isNotNull(strategy, "RelyingPartyContext lookup strategy cannot be null");
}
/**
@@ -100,28 +76,6 @@ public class UserInfoEndpointLookup extends AbstractHttpOIDCAuthenticationAction
userInfoResponseContextLookupStrategy = Constraint.isNotNull(strategy,
"UserInfoResponseContext lookup strategy cannot be null");
}
-
- @Override
- protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext,
- @Nonnull final AuthenticationContext authenticationContext) {
-
- if (!super.doPreExecute(profileRequestContext, authenticationContext)) {
- return false;
- }
-
- final RelyingPartyContext rpCtx = relyingPartyContextLookupStrategy.apply(profileRequestContext);
- if (rpCtx != null && rpCtx.getConfiguration() != null &&
- rpCtx.getProfileConfig() instanceof OIDCAuthorizationConfiguration) {
- profileConfiguration = (OIDCAuthorizationConfiguration) rpCtx.getProfileConfig();
- }
- if (profileConfiguration == null) {
- log.error("{} OIDCAuthorizationConfiguration not found", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_PROFILE_CONFIG);
- return false;
- }
-
- return true;
- }
@Override protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext,
@Nonnull final AuthenticationContext authenticationContext) {
@@ -136,21 +90,9 @@ public class UserInfoEndpointLookup extends AbstractHttpOIDCAuthenticationAction
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
return;
}
-
- try {
-
- final UserInfoResponse response = handleRequest(profileRequestContext);
-
- final boolean requireJWTType =
- profileConfiguration.requireJWTUserInfoResponses(profileRequestContext);
-
- if (requireJWTType && response.getType() == UserInfoResponseType.PLAIN) {
- log.error("{} JWT UserInfo response required, but plain JSON Object returned",getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.AUTHN_EXCEPTION);
- return;
- }
-
- userInfoCtx.setUserInfo(response);
+
+ try {
+ userInfoCtx.setUserInfo(handleRequest(profileRequestContext));
} catch (final OIDCRPException e) {
log.error("{} Unable to return claims from UserInfo endpoint",getLogPrefix(),e);
ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.AUTHN_EXCEPTION);
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index 4d61a81..55f25fb 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -29,8 +29,7 @@
p:clientCredential="#{%{idp.authn.oidc.rp.provider.discoveryRequired:false} == true ? {null} : getObject('shibboleth.authn.oidc.rp.DefaultCredential')}"
p:tokenEndpointAuthMethods="%{idp.authn.oidc.rp.client.authenticationMethod:client_secret_basic}"
p:responseMode="%{idp.authn.oidc.rp.client.responseMode:#{null}}"
- p:retrieveUserInfoEndpointClaims="%{idp.authn.oidc.rp.client.userinfo.enabled:true}"
- p:requireJWTUserInfoResponses="%{idp.authn.oidc.rp.client.userinfo.requireJWTResponse:false}"
+ p:retrieveUserInfoEndpointClaims="%{idp.authn.oidc.rp.client.userinfo.enabled:true}"
p:redirectUriOverride="%{idp.authn.oidc.rp.client.redirectURI:#{null}}"
p:encryptRequestObject="%{idp.authn.oidc.rp.client.requestobject.encrypted:false}"
p:signRequestObject="%{idp.authn.oidc.rp.client.requestobject.signed:true}"
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list