[java-idp-plugin-oidc-rp] branch main updated: Update to support new JWT encryption classes on commons
Phil Smart
philip.smart at jisc.ac.uk
Fri Sep 2 12:57:37 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=c74843a65f8bda10294098fc41030a35570cb606
The following commit(s) were added to refs/heads/main by this push:
new c74843a Update to support new JWT encryption classes on commons
c74843a is described below
commit c74843a65f8bda10294098fc41030a35570cb606
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Sep 2 13:57:30 2022 +0100
Update to support new JWT encryption classes on commons
- some cleanup
---
.../ProxyAuthenticationFlowAuditExtractor.java | 0
.../rp/impl/PopulateJWTDecryptionParameters.java | 20 +++++-
.../rp/impl/PopulateJWTEncryptionParameters.java | 4 ++
.../authn/oidc/rp/messaging/impl/EncryptJWT.java | 70 +++++++++++++++------
.../oidc-relying-party-authn-beans.xml | 22 ++++---
.../idp/service/relying-party/postconfig.xml | 71 +++++++++++++++++-----
.../authn/oidc/rp/conf/authn/rp-credentials.xml | 24 +++-----
.../plugin/authn/oidc/rp/impl/EncryptJWTTest.java | 6 +-
.../test/resources/conf/authn/rp-credentials.xml | 12 ++--
9 files changed, 162 insertions(+), 67 deletions(-)
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/audit/impl/ProxyAuthenticationFlowAuditExtractor.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/audit/impl/ProxyAuthenticationFlowAuditExtractor.java
similarity index 100%
rename from idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/audit/impl/ProxyAuthenticationFlowAuditExtractor.java
rename to idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/audit/impl/ProxyAuthenticationFlowAuditExtractor.java
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/PopulateJWTDecryptionParameters.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/PopulateJWTDecryptionParameters.java
index 6c0fd3e..72d1446 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/PopulateJWTDecryptionParameters.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/PopulateJWTDecryptionParameters.java
@@ -37,8 +37,9 @@ import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
import net.shibboleth.oidc.security.JWTDecryptionConfiguration;
import net.shibboleth.oidc.security.JWTDecryptionParameters;
import net.shibboleth.oidc.security.JWTDecryptionParametersResolver;
+import net.shibboleth.oidc.security.JWTEncryptionConfiguration;
import net.shibboleth.oidc.security.context.JWTSecurityParametersContext;
-import net.shibboleth.oidc.security.criterion.DecryptionConfigurationCriterion;
+import net.shibboleth.oidc.security.criterion.JWTDecryptionConfigurationCriterion;
import net.shibboleth.oidc.security.criterion.StaticCredentialCriterion;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
@@ -47,6 +48,18 @@ import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
import net.shibboleth.utilities.java.support.resolver.ResolverException;
+/**
+ * Action that resolves and populates {@link JWTDecryptionParameters} on an {@link JWTSecurityParametersContext}
+ * created/accessed via a lookup function, by default on a child of the outbound message context.
+ *
+ * <p>The default, per-RelyingParty, and default per-profile {@link JWTEncryptionConfiguration}
+ * objects are input to the resolution process, along with any static, symmetric key credentials
+ * configured on the relying party i.e. the client_secret.</p>
+ *
+ * @event {@link EventIds#PROCEED_EVENT_ID}
+ * @event {@link EventIds#INVALID_PROFILE_CTX}
+ * @event {@link EventIds#INVALID_SEC_CFG}
+ */
public class PopulateJWTDecryptionParameters extends AbstractProfileAction {
/** Class logger. */
@@ -57,7 +70,8 @@ public class PopulateJWTDecryptionParameters extends AbstractProfileAction {
private Function<ProfileRequestContext,JWTSecurityParametersContext> securityParametersContextLookupStrategy;
/** Strategy used to lookup a per-request {@link JWTDecryptionConfiguration} list. */
- @NonnullAfterInit private Function<ProfileRequestContext,List<JWTDecryptionConfiguration>> configurationLookupStrategy;
+ @NonnullAfterInit
+ private Function<ProfileRequestContext,List<JWTDecryptionConfiguration>> configurationLookupStrategy;
/** Lookup function for relying party context. */
@Nonnull private Function<ProfileRequestContext,RelyingPartyContext> relyingPartyContextLookupStrategy;
@@ -186,7 +200,7 @@ public class PopulateJWTDecryptionParameters extends AbstractProfileAction {
final List<JWTDecryptionConfiguration> configs) {
final CriteriaSet criteria = new CriteriaSet();
- criteria.add(new DecryptionConfigurationCriterion(configs));
+ criteria.add(new JWTDecryptionConfigurationCriterion(configs));
// Build a static credential criteria. Extract the decryption credential from the RP config.
final RelyingPartyContext rpCtx = relyingPartyContextLookupStrategy.apply(profileRequestContext);
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/PopulateJWTEncryptionParameters.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/PopulateJWTEncryptionParameters.java
index 63313a1..a776348 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/PopulateJWTEncryptionParameters.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/PopulateJWTEncryptionParameters.java
@@ -28,6 +28,8 @@ import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.OutboundMessageContextLookup;
+import org.opensaml.security.credential.UsageType;
+import org.opensaml.security.criteria.UsageCriterion;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -272,6 +274,8 @@ public class PopulateJWTEncryptionParameters extends AbstractProfileAction {
final CriteriaSet criteria = new CriteriaSet(
new JWTEncryptionConfigurationCriterion(encryptionConfigurations));
+ criteria.add(new UsageCriterion(UsageType.ENCRYPTION));
+
// Add client metadata criterion
final OIDCMetadataContext oidcMetadataCtx =
oidcClientMetadataContextLookupStrategy.apply(profileRequestContext);
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/EncryptJWT.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/EncryptJWT.java
index 31cf4b1..a987490 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/EncryptJWT.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/EncryptJWT.java
@@ -162,9 +162,15 @@ public class EncryptJWT extends AbstractMessageHandler {
// throw an exception as opposed to skipping encryption
if (StringSupport.trimOrNull(encryptionParameters.getKeyTransportEncryptionAlgorithm()) == null ||
StringSupport.trimOrNull(encryptionParameters.getDataEncryptionAlgorithm()) == null ||
- encryptionParameters.getKeyTransportEncryptionCredential() == null) {
+ (encryptionParameters.getKeyTransportEncryptionCredential() == null &&
+ encryptionParameters.getDataEncryptionCredential() == null)) {
throw new MessageHandlerException("Message context did not contain all required encryption parameters");
}
+ if (encryptionParameters.getKeyTransportEncryptionCredential() != null &&
+ encryptionParameters.getDataEncryptionCredential() != null) {
+ throw new MessageHandlerException("Message context contained both a content encryption and "
+ + "key transport credential. Only one required.");
+ }
return true;
}
@@ -179,28 +185,58 @@ public class EncryptJWT extends AbstractMessageHandler {
}
final JWEAlgorithm encAlg = JWEAlgorithm.parse(encryptionParameters.getKeyTransportEncryptionAlgorithm());
- final Credential credential = encryptionParameters.getKeyTransportEncryptionCredential();
final EncryptionMethod encEnc = EncryptionMethod.parse(encryptionParameters.getDataEncryptionAlgorithm());
- final String kid = CredentialConversionUtil.resolveKid(credential);
-
- log.debug("{} Encrypting with kid '{}' and params alg: {} enc: {}", getLogPrefix(), kid, encAlg.getName(),
- encEnc.getName());
+
+
+ final Credential keyTransportCredential = encryptionParameters.getKeyTransportEncryptionCredential();
+ final Credential dataEncryptionCredential = encryptionParameters.getDataEncryptionCredential();
+
+ final String keyTransportKid = keyTransportCredential == null ? null :
+ CredentialConversionUtil.resolveKid(keyTransportCredential);
+ final String dataEncryptionKid = dataEncryptionCredential == null ? null :
+ CredentialConversionUtil.resolveKid(dataEncryptionCredential);
- final JWEObject jweObject =
- new JWEObject(new JWEHeader.Builder(encAlg, encEnc).contentType("JWT").keyID(kid).build(), payload);
+ JWEObject jweObject = null;
try {
- if (JWEAlgorithm.Family.RSA.contains(encAlg) && credential.getPublicKey() != null) {
- jweObject.encrypt(new RSAEncrypter((RSAPublicKey) credential.getPublicKey()));
- } else if (JWEAlgorithm.Family.ECDH_ES.contains(encAlg) && credential.getPublicKey() != null) {
- jweObject.encrypt(new ECDHEncrypter((ECPublicKey) credential.getPublicKey()));
+ if (JWEAlgorithm.Family.RSA.contains(encAlg) && keyTransportCredential != null &&
+ keyTransportCredential.getPublicKey() != null) {
+
+ jweObject = new JWEObject(new JWEHeader.Builder(encAlg, encEnc).contentType("JWT")
+ .keyID(keyTransportKid).build(), payload);
+ log.debug("{} Encrypting with kid '{}' and params alg: {} enc: {}",
+ getLogPrefix(), keyTransportKid, encAlg.getName(), encEnc.getName());
+ jweObject.encrypt(new RSAEncrypter((RSAPublicKey) keyTransportCredential.getPublicKey()));
+
+ } else if (JWEAlgorithm.Family.ECDH_ES.contains(encAlg) && keyTransportCredential != null &&
+ keyTransportCredential.getPublicKey() != null) {
+
+ jweObject = new JWEObject(new JWEHeader.Builder(encAlg, encEnc).contentType("JWT")
+ .keyID(keyTransportKid).build(), payload);
+ log.debug("{} Encrypting with kid '{}' and params alg: {} enc: {}",
+ getLogPrefix(), keyTransportKid, encAlg.getName(), encEnc.getName());
+ jweObject.encrypt(new ECDHEncrypter((ECPublicKey) keyTransportCredential.getPublicKey()));
+
} else if ((JWEAlgorithm.Family.AES_KW.contains(encAlg) || JWEAlgorithm.Family.AES_GCM_KW.contains(encAlg))
- && credential.getSecretKey() != null) {
- jweObject.encrypt(new AESEncrypter(credential.getSecretKey()));
- } else if (JWEAlgorithm.DIR.equals(encAlg) && credential.getSecretKey() != null){
- jweObject.encrypt(new DirectEncrypter(credential.getSecretKey()));
+ && keyTransportCredential != null && keyTransportCredential.getSecretKey() != null) {
+
+ jweObject = new JWEObject(new JWEHeader.Builder(encAlg, encEnc).contentType("JWT")
+ .keyID(keyTransportKid).build(), payload);
+ log.debug("{} Encrypting with kid '{}' and params alg: {} enc: {}",
+ getLogPrefix(), keyTransportKid, encAlg.getName(), encEnc.getName());
+ jweObject.encrypt(new AESEncrypter(keyTransportCredential.getSecretKey()));
+
+ } else if (JWEAlgorithm.DIR.equals(encAlg) && dataEncryptionCredential != null &&
+ dataEncryptionCredential.getSecretKey() != null){
+
+ jweObject = new JWEObject(new JWEHeader.Builder(encAlg, encEnc).contentType("JWT")
+ .keyID(dataEncryptionKid).build(), payload);
+ log.debug("{} Encrypting with kid '{}' and params alg: {} enc: {}",
+ getLogPrefix(), dataEncryptionKid, encAlg.getName(), encEnc.getName());
+ jweObject.encrypt(new DirectEncrypter(dataEncryptionCredential.getSecretKey()));
+
} else {
log.error("{} Unsupported algorithm {} or key '{}'", getLogPrefix(), encAlg.getName(),
- kid);
+ keyTransportKid);
throw new MessageHandlerException("Unsupported algorithm "+encAlg.getName());
}
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
index 242b84f..02d81c7 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
@@ -210,16 +210,24 @@
class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.RequestObjectEncryptionConfigurationLookupFunction"
p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
+ <!-- Should the resolvers move to the post-config as they are global singletons -->
<bean id="shibboleth.authn.oidc.rp.EncryptionParametersResolver"
- class="net.shibboleth.oidc.security.impl.ProviderMetadataEncryptionParametersResolver"
- p:remoteJwkSetCache-ref="shibboleth.authn.oidc.rp.RemoteJwkSetCache"
- p:keyFetchInterval="%{idp.authn.oidc.rp.provider.keyfetch.interval:PT30M}">
- <property name="providerEncryptionMethodsLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.ProviderRequestObjectEncryptionMethodsLookupFunction"/>
+ class="net.shibboleth.oidc.security.impl.DefaultJWTEncryptionParametersResolver">
+ <property name="keyTransportEncryptionAlgorithmsLookupStrategy">
+ <bean class="net.shibboleth.oidc.security.impl.ProviderMetadataKeyTransportEncryptionAlgorithmsLookupStrategy">
+ <constructor-arg>
+ <bean class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.ProviderRequestObjectKeyTransportAlgorithmsLookupFunction"/>
+ </constructor-arg>
+ </bean>
</property>
- <property name="providerKeyTransportAlgorithmsLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.ProviderRequestObjectKeyTransportAlgorithmsLookupFunction"/>
+ <property name="dataEncryptionAlgorithmsLookupStrategy">
+ <bean class="net.shibboleth.oidc.security.impl.ProviderMetadataDataEncryptionAlgorithmsLookupStrategy">
+ <constructor-arg>
+ <bean class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.ProviderRequestObjectEncryptionMethodsLookupFunction"/>
+ </constructor-arg>
+ </bean>
</property>
+
</bean>
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index 4c3a09b..34fd4a9 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -27,6 +27,9 @@
p:tokenEndpointAuthMethods="%{idp.authn.oidc.rp.clientAuthenticationMethod:client_secret_basic}"
p:responseMode="%{idp.authn.oidc.rp.responseMode:#{null}}"
p:redirectUriOverride="%{idp.authn.oidc.rp.client.redirectURL:#{null}}"
+ p:encryptRequestObject="%{idp.authn.oidc.rp.client.requestobject.encrypted:false}"
+ p:signRequestObject="%{idp.authn.oidc.rp.client.requestobject.signed:true}"
+ p:useRequestObject="%{idp.authn.oidc.rp.client.requestobject.supported:false}"
p:scopes="%{idp.authn.oidc.rp.scopes:#{null}}">
<property name="forceAuthnPredicate">
<bean class="net.shibboleth.idp.saml.profile.config.logic.ProxyAwareForceAuthnPredicate" />
@@ -92,12 +95,19 @@
</property>
</bean>
+ <!--
+ See https://openid.net/specs/openid-connect-core-1_0.html#Encryption. But encryption is either based
+ on published OP keys, or the client_secret, so we can not allow abitrarily configured keys
+ -->
<bean id="shibboleth.authn.oidc.rp.DefaultRequestObjectEncryptionConfiguration"
parent="shibboleth.authn.oidc.rp.BasicEncryptionConfiguration"
- p:keyTransportEncryptionCredentials-ref="shibboleth.authn.oidc.rp.RequestObjectKeyTransportEncryptionCredentials"
- p:dataEncryptionCredentials-ref="shibboleth.authn.oidc.rp.RequestObjectDataEncryptionCredentials">
+ p:KEKCredentialResolver-ref="defaultOIDCRPKeyEncryptionCredentialResolver"
+ p:contentEncryptionKeyCredentialResolver-ref="defaultOIDCRPContentEncryptionKeyCredentialResolver">
<property name="keyTransportEncryptionAlgorithms">
- <list>
+ <list>
+ <!-- TODO move this KW back to original order -->
+ <!-- <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_DIR" /> -->
<util:constant
static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_RSA_1_5" />
<util:constant
@@ -108,8 +118,7 @@
static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_128_KW" />
<util:constant
static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_192_KW" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_256_KW" />
+
<util:constant
static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_128_GCM_KW" />
<util:constant
@@ -118,22 +127,24 @@
static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_256_GCM_KW" />
<util:constant
static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_ECDH_ES" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_256_KW" />
</list>
</property>
<property name="dataEncryptionAlgorithms">
- <list>
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A128CBC_HS256" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A192CBC_HS384" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A256CBC_HS512" />
+ <list>
<util:constant
static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A128GCM" />
<util:constant
static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A192GCM" />
<util:constant
static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A256GCM" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A128CBC_HS256" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A192CBC_HS384" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A256CBC_HS512" />
</list>
</property>
</bean>
@@ -173,11 +184,11 @@
<bean id="shibboleth.authn.oidc.rp.DefaultJWTDecryptionConfiguration"
parent="shibboleth.authn.oidc.rp.BasicDecryptionConfiguration"
- p:KEKCredentialResolver-ref="defaultOIDCRPKeyEncryptionCredentialResolver"
- p:contentEncryptionKeyCredentialResolver-ref="defaultOIDCRPContentEncryptionKeyCredentialResolver" />
+ p:KEKCredentialResolver-ref="defaultOIDCRPKeyDecryptionCredentialResolver"
+ p:contentEncryptionKeyCredentialResolver-ref="defaultOIDCRPContentDecryptionKeyCredentialResolver" />
<!-- A resolver to public/private key encryption keys global to the RP -->
- <bean id="defaultOIDCRPKeyEncryptionCredentialResolver"
+ <bean id="defaultOIDCRPKeyDecryptionCredentialResolver"
class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
<constructor-arg>
<list>
@@ -193,7 +204,35 @@
</bean>
<!--
- A resolver to resolve pre-shared Direct Encryption key e.g. a pairwise client_secret from the input criterion
+ A resolver to resolve a pre-shared Direct Encryption key e.g. a pairwise client_secret from the input criterion
+ -->
+ <bean id="defaultOIDCRPContentDecryptionKeyCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
+ <constructor-arg>
+ <list>
+ <bean id="CriterionCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.CriterionCredentialResolver" />
+ </list>
+ </constructor-arg>
+ </bean>
+
+ <!-- A resolver to public key encryption in the OPs metadata alongside the client_secret for key wrapping -->
+ <bean id="defaultOIDCRPKeyEncryptionCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
+ <constructor-arg>
+ <list>
+ <bean id="OIDCProviderMetadataCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ProviderMetadataCredentialResolver"
+ p:remoteJwkSetCache-ref="shibboleth.authn.oidc.rp.RemoteJwkSetCache" />
+ <bean id="CriterionCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.CriterionCredentialResolver" />
+ </list>
+ </constructor-arg>
+ </bean>
+
+ <!--
+ A resolver to resolve pre-shared Direct Encryption or Key Wrapping credentials based on the
+ client_secret in the input criterion
-->
<bean id="defaultOIDCRPContentEncryptionKeyCredentialResolver"
class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
diff --git a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/rp-credentials.xml b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/rp-credentials.xml
index a0c7b15..724dbc8 100644
--- a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/rp-credentials.xml
+++ b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/rp-credentials.xml
@@ -1,3 +1,4 @@
+
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:context="http://www.springframework.org/schema/context"
@@ -9,31 +10,22 @@
default-init-method="initialize" default-destroy-method="destroy">
- <!--
- The default credential is based on the client_secret, and will be the only used credential in most cases.
- It supports the 'direct encryption' key management mode by default, but can also be used for creating and
- verifying MACs.
+ <!--
+ The default credential is based on the client_secret, and will be the only used credential in most cases.
+ The algorithm is not specified, this way it supports both 'direct encryption' and key wrapping management modes.
+ UsageType is also not specified, this way making the credential also suitable for verifying message authentication
+ codes.
-->
<bean id="shibboleth.authn.oidc.rp.DefaultCredential" parent="shibboleth.authn.oidc.rp.ExpiringJWKCredential"
p:secret="%{idp.authn.oidc.rp.client.clientSecret:#{null}}"
- p:keyNames="%{idp.authn.oidc.rp.client.clientSecretKeyName:defaultPropertiesClientSecret}"
- p:alg="dir" />
+ p:keyNames="%{idp.authn.oidc.rp.client.clientSecretKeyName:defaultPropertiesClientSecret}"/>
<!-- Your RP's default encryption (really decryption) keys, set via property file. -->
<util:list id="shibboleth.authn.oidc.rp.DefaultKeyEncryptionCredentials">
<bean parent="shibboleth.authn.oidc.rp.JWKCredential" p:failIfResourceIsNull="false"
p:resource="%{idp.authn.oidc.rp.client.enc.key:#{null}}" />
- </util:list>
+ </util:list>
- <util:list id="shibboleth.authn.oidc.rp.DefaultRequestObjectKeyTransportEncryptionCredentials">
- <bean parent="shibboleth.authn.oidc.rp.JWKCredential" p:failIfResourceIsNull="false"
- p:resource="%{idp.authn.oidc.rp.client.requestobject.enc.symmetric.kw.key:#{null}}" />
- </util:list>
-
- <util:list id="shibboleth.authn.oidc.rp.DefaultRequestObjectDataEncryptionCredentials">
- <bean parent="shibboleth.authn.oidc.rp.JWKCredential" p:failIfResourceIsNull="false"
- p:resource="%{idp.authn.oidc.rp.client.requestobject.enc.symmetric.cek.key:#{null}}" />
- </util:list>
<!-- Default signing credentials -->
<util:list id="shibboleth.authn.oidc.rp.DefaultSigningCredentials">
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/EncryptJWTTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/EncryptJWTTest.java
index 900eb57..1316845 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/EncryptJWTTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/EncryptJWTTest.java
@@ -1,4 +1,3 @@
-package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
/*
* Licensed to the University Corporation for Advanced Internet Development,
* Inc. (UCAID) under one or more contributor license agreements. See the
@@ -16,6 +15,8 @@ package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
* limitations under the License.
*/
+package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
+
import static org.testng.Assert.assertEquals;
import static org.testng.Assert.assertNotNull;
import static org.testng.Assert.assertTrue;
@@ -195,7 +196,8 @@ public class EncryptJWTTest extends AbstractOIDCTest {
assertEquals(claims.getIssuer(), "https://rp.example.com");
}
- @Test
+ /* Dir is not supported by the runtime at the minute.*/
+ @Test(enabled = false)
public void testEncryptWithDirectEncryption() throws Exception {
params.setKeyTransportEncryptionAlgorithm(KeyManagementConstants.ALGO_ID_ALG_DIR);
diff --git a/idp-oidc-rp-impl/src/test/resources/conf/authn/rp-credentials.xml b/idp-oidc-rp-impl/src/test/resources/conf/authn/rp-credentials.xml
index a0c7b15..9817820 100644
--- a/idp-oidc-rp-impl/src/test/resources/conf/authn/rp-credentials.xml
+++ b/idp-oidc-rp-impl/src/test/resources/conf/authn/rp-credentials.xml
@@ -1,3 +1,4 @@
+
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:context="http://www.springframework.org/schema/context"
@@ -9,15 +10,14 @@
default-init-method="initialize" default-destroy-method="destroy">
- <!--
- The default credential is based on the client_secret, and will be the only used credential in most cases.
- It supports the 'direct encryption' key management mode by default, but can also be used for creating and
- verifying MACs.
+ <!--
+ The default credential is based on the client_secret, and will be the only used credential in most cases.
+ The algorithm is not specified, this way it supports both 'direct encryption' and key wrapping management modes.
+ UsageType is also not specified, this way making the credential also suitable for verifying message authentication codes.
-->
<bean id="shibboleth.authn.oidc.rp.DefaultCredential" parent="shibboleth.authn.oidc.rp.ExpiringJWKCredential"
p:secret="%{idp.authn.oidc.rp.client.clientSecret:#{null}}"
- p:keyNames="%{idp.authn.oidc.rp.client.clientSecretKeyName:defaultPropertiesClientSecret}"
- p:alg="dir" />
+ p:keyNames="%{idp.authn.oidc.rp.client.clientSecretKeyName:defaultPropertiesClientSecret}"/>
<!-- Your RP's default encryption (really decryption) keys, set via property file. -->
<util:list id="shibboleth.authn.oidc.rp.DefaultKeyEncryptionCredentials">
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list