[java-idp-plugin-oidc-rp] branch main updated: Remove unused classes. Some code cleanup
Phil Smart
philip.smart at jisc.ac.uk
Wed Sep 7 14:41:06 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=0155a686280b4dc2ac4c5e7ec7b2429c368f5390
The following commit(s) were added to refs/heads/main by this push:
new 0155a68 Remove unused classes. Some code cleanup
0155a68 is described below
commit 0155a686280b4dc2ac4c5e7ec7b2429c368f5390
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Sep 7 15:41:00 2022 +0100
Remove unused classes. Some code cleanup
---
...AbstractClientAuthenticationLookupStrategy.java | 74 -------
.../DefaultClientAuthenticationLookupStrategy.java | 215 ---------------------
.../DefaultClientIdentifierLookupStrategy.java | 106 ----------
.../config/DefaultClientSecretLookupStrategy.java | 146 --------------
.../MapBackedMemoryStorageServiceFactoryBean.java | 129 -------------
.../decoding/impl/DefaultMapResponseDecoder.java | 2 +-
.../impl/DefaultAuthCodeTokenRequestEncoder.java | 1 +
...actOIDCAuthenticationRequestMessageHandler.java | 3 +-
.../authn/oidc/rp/messaging/impl/AddState.java | 10 +-
.../authn/oidc/rp/messaging/impl/EncryptJWT.java | 41 ++--
.../impl/{SignRequestObject.java => SignJWT.java} | 32 ++-
.../DefaultClientIDForIssuerLookupFunction.java | 22 ++-
.../impl/DefaultIssuerIDLookupFunction.java | 18 ++
.../impl/FilesystemClientInformationResolver.java | 171 ----------------
.../oidc-relying-party-authn-beans.xml | 6 +-
.../idp/service/relying-party/postconfig.xml | 4 +-
...aultClientAuthenticationLookupStrategyTest.java | 188 ------------------
.../oidc/rp/impl/AuthorizationControllerTest.java | 4 +-
...SignRequestObjectTest.java => SignJWTTest.java} | 8 +-
.../oidc-client-registration-authentication.xml | 28 ---
.../authn/oidc-client-registration-clientid.xml | 21 --
.../conf/authn/oidc-clientinfo-resolvers.xml | 23 ---
.../test/resources/conf/authn/rp-credentials.xml | 1 -
23 files changed, 114 insertions(+), 1139 deletions(-)
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/AbstractClientAuthenticationLookupStrategy.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/AbstractClientAuthenticationLookupStrategy.java
deleted file mode 100644
index 63330fc..0000000
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/AbstractClientAuthenticationLookupStrategy.java
+++ /dev/null
@@ -1,74 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.authn.oidc.rp.config;
-
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import com.nimbusds.oauth2.sdk.auth.ClientAuthentication;
-import com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod;
-import com.nimbusds.oauth2.sdk.auth.ClientSecretBasic;
-import com.nimbusds.oauth2.sdk.auth.ClientSecretPost;
-import com.nimbusds.oauth2.sdk.auth.Secret;
-import com.nimbusds.oauth2.sdk.id.ClientID;
-
-import net.shibboleth.utilities.java.support.component.AbstractIdentifiableInitializableComponent;
-
-/** Base function to support lookup of a suitable client authentication methods.*/
-public abstract class AbstractClientAuthenticationLookupStrategy extends AbstractIdentifiableInitializableComponent
- implements Function<ProfileRequestContext, ClientAuthentication> {
-
- /** Class logger. */
- private final Logger log = LoggerFactory.getLogger(AbstractClientAuthenticationLookupStrategy.class);
-
- /**
- * Construct the client authentication from the given client authentication record.
- *
- * @param clientId the client_id
- * @param tokenEndpointAuthMethod the token endpoint authentication method
- * @param clientSecret the client secret
- *
- * @return the constructed client authentication
- */
- @Nullable protected ClientAuthentication constructClientAuthentication(
- @Nonnull final String clientId, @Nonnull final String tokenEndpointAuthMethod,
- @Nonnull final Secret clientSecret) {
-
- if (clientSecret.expired()) {
- log.warn("{} Client secret has expired for client '{}'", getId(), clientId);
- return null;
- }
- final ClientAuthenticationMethod method = new ClientAuthenticationMethod(tokenEndpointAuthMethod);
- if (method.equals(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)) {
- return new ClientSecretBasic(new ClientID(clientId), clientSecret);
- } else if (method.equals(ClientAuthenticationMethod.CLIENT_SECRET_POST)) {
- return new ClientSecretPost(new ClientID(clientId), clientSecret);
- }
- log.warn("{}: Client authentication method '{}' not supported for client '{}'", getId(),
- tokenEndpointAuthMethod, clientId);
- return null;
-
- }
-
-}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/DefaultClientAuthenticationLookupStrategy.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/DefaultClientAuthenticationLookupStrategy.java
deleted file mode 100644
index 1b0944b..0000000
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/DefaultClientAuthenticationLookupStrategy.java
+++ /dev/null
@@ -1,215 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.authn.oidc.rp.config;
-
-import java.time.Duration;
-import java.time.Instant;
-import java.util.Collections;
-import java.util.Date;
-import java.util.Map;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.profile.context.navigate.OutboundMessageContextLookup;
-
-import com.nimbusds.oauth2.sdk.auth.ClientAuthentication;
-import com.nimbusds.oauth2.sdk.auth.Secret;
-
-import net.shibboleth.idp.plugin.authn.oidc.rp.context.OAuth2ClientContext;
-import net.shibboleth.idp.plugin.authn.oidc.rp.context.OIDCPeerEntityContext;
-import net.shibboleth.idp.plugin.authn.oidc.rp.storage.ClientAuthenticationDetails;
-import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
-import net.shibboleth.utilities.java.support.annotation.constraint.ThreadSafeAfterInit;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-import net.shibboleth.utilities.java.support.component.ComponentSupport;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.primitive.StringSupport;
-
-/**
- * A strategy that produces a client authentication method either directly from the information supplied,
- * or derived from a lookup strategy.
- *
- * @deprecated see see InitializeOAuth2ClientAuthenticationContext
- */
- at ThreadSafeAfterInit
- at Deprecated
-public class DefaultClientAuthenticationLookupStrategy extends AbstractClientAuthenticationLookupStrategy {
-
- /** A fixed client_id to use.*/
- @Nullable private String clientId;
-
- /** A fixed client_secret to use over any injected strategy to locate one .*/
- @Nullable private char[] clientSecret;
-
- /** A fixed client authentication method to use.*/
- @Nullable private String clientAuthenticationMethod;
-
- /** A fixed client secret expiry in seconds since UNIX EPOCH to use.*/
- @Nullable private Duration clientSecretExpiresAt;
-
- /** Map of client_id to client authentication details used to construct a {@link ClientAuthentication}.*/
- @Nullable @NotLive private Map<String, ClientAuthenticationDetails> clientIdToClientAuthenticationMap;
-
- /** The strategy used to lookup or create the {@link OAuth2ClientContext}.*/
- @Nonnull private Function<ProfileRequestContext, OAuth2ClientContext> oauth2ClientContextLookupStrategy;
-
-
- /**
- * Constructor.
- */
- public DefaultClientAuthenticationLookupStrategy() {
- oauth2ClientContextLookupStrategy = new ChildContextLookup<>(OAuth2ClientContext.class).compose(
- new ChildContextLookup<>(OIDCPeerEntityContext.class).compose(
- new OutboundMessageContextLookup()));
- }
-
- @Override
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
-
- if (clientIdToClientAuthenticationMap == null && clientSecret == null &&
- clientAuthenticationMethod == null && clientSecretExpiresAt == null) {
-
- throw new ComponentInitializationException("Must supply a client_secret, client_authentication_method,"
- + " and client_secret_expires_at if a client authentication map is not supplied");
- }
-
- }
-
- /**
- * Set the client_id.
- *
- * @param id the client_id
- */
- public void setClientId(@Nullable final String id) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
-
- clientId = StringSupport.trimOrNull(id);
- }
-
- /**
- * Set the client authentication method.
- *
- * @param authMethod the client authentication method
- */
- public void setClientAuthenticationMethod(@Nullable final String authMethod) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
-
- clientAuthenticationMethod = StringSupport.trimOrNull(authMethod);
- }
-
- /**
- * Set the client_secret.
- *
- * @param secret the client_secret
- */
- public void setClientSecret(@Nullable final char[] secret) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
-
- clientSecret = secret;
- }
-
- /**
- * Set when the client_secret expires. A duration of 0 means the secret does not expire.
- *
- * @param expiresAt when the client secret expires, or 0 for no expiry.
- */
- public void setClientSecretExpiresAt(@Nullable final Duration expiresAt) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
-
- clientSecretExpiresAt = expiresAt;
- }
-
- /**
- * Set the client_id to client authentication details map.
- *
- * @param map the map of client_id to client authentication details
- */
- public void setClientIdToClientAuthenticationMap(
- @Nullable final Map<String, ClientAuthenticationDetails> map) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
-
- if (map == null) {
- clientIdToClientAuthenticationMap = Collections.emptyMap();
- } else {
- clientIdToClientAuthenticationMap = Collections.unmodifiableMap(map);
- }
- }
-
- /**
- * Set the strategy to lookup the {@link OAuth2ClientContext}
- * from the {@link ProfileRequestContext}.
- *
- * @param strgy the strategy.
- */
- public void setOAuth2ClientContextLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, OAuth2ClientContext> strgy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
-
- oauth2ClientContextLookupStrategy = Constraint.isNotNull(strgy,
- "OAuth2 client context lookup strategy cannot be null");
- }
-
- @Override
- @Nullable public ClientAuthentication apply(@Nonnull final ProfileRequestContext profileRequestContext) {
-
- // Use supplied client authentication parameters first
- if (clientSecret != null && clientAuthenticationMethod != null && clientSecretExpiresAt != null
- && clientId != null) {
- if (clientSecretExpiresAt.toSeconds() == 0) {
- // No expiry if 0, so do not set.
- return constructClientAuthentication(clientId, clientAuthenticationMethod,
- new Secret(new String(clientSecret)));
-
- }
- return constructClientAuthentication(clientId, clientAuthenticationMethod,
- new Secret(new String(clientSecret),
- Date.from(Instant.ofEpochSecond(clientSecretExpiresAt.toSeconds()))));
- }
-
- // Else pull it from the map
- final OAuth2ClientContext clientCtx = oauth2ClientContextLookupStrategy.apply(profileRequestContext);
- if (clientCtx == null || StringSupport.trimOrNull(clientCtx.getClientId()) == null) {
- return null;
- }
- final ClientAuthenticationDetails details =
- clientIdToClientAuthenticationMap.get(clientCtx.getClientId());
-
- if (details.getClientSecretExpiresAt() == 0) {
- return constructClientAuthentication(
- clientCtx.getClientId(), details.getTokenEndpointAuthMethod(),
- new Secret(new String(details.getClientSecret())));
- } else {
- final Instant secretExpiration = Instant.ofEpochSecond(details.getClientSecretExpiresAt());
- return constructClientAuthentication(
- clientCtx.getClientId(), details.getTokenEndpointAuthMethod(),
- new Secret(new String(details.getClientSecret()), Date.from(secretExpiration)));
- }
- }
-
-}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/DefaultClientIdentifierLookupStrategy.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/DefaultClientIdentifierLookupStrategy.java
deleted file mode 100644
index 34e513b..0000000
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/DefaultClientIdentifierLookupStrategy.java
+++ /dev/null
@@ -1,106 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.authn.oidc.rp.config;
-
-import java.util.Collections;
-import java.util.Map;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-import javax.annotation.concurrent.ThreadSafe;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.oidc.metadata.context.OIDCProviderMetadataContext;
-import net.shibboleth.utilities.java.support.annotation.ParameterName;
-import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.primitive.StringSupport;
-
-/**
- * A strategy that produces a client_id either directly from the one supplied, or derived from the
- * lookup strategy.
- */
- at ThreadSafe
-public class DefaultClientIdentifierLookupStrategy implements Function<ProfileRequestContext, String> {
-
- /** A fixed client_id to use over any injected strategy to locate one.*/
- @Nullable private final String clientId;
-
- /** Map of issuer to client_id. Can be {@literal null} if a fixed client_id is used.*/
- @Nullable @NotLive private final Map<String, String> issuerToClientIdMap;
-
- /** Lookup strategy to locate the provider metadata to use.*/
- @NonnullAfterInit
- private final Function<ProfileRequestContext, OIDCProviderMetadataContext> providerMetadataLookupStrategy;
-
- /**
- *
- * Constructor.
- *
- * @param id a client_id that takes precedence over one derived from the lookup strategy.
- * @param map the map used to derive a client_id for the input profile request context.
- * @param strategy the strategy used to locate the provider metadata to find the issuer id.
- *
- * @throws ComponentInitializationException if both id and strategy are null, one is required.
- */
- public DefaultClientIdentifierLookupStrategy(@ParameterName(name="clientId") @Nullable final String id,
- @ParameterName(name="issuerToClientIdMap") @Nullable final Map<String, String> map,
- @Nonnull @ParameterName(name="providerMetadataLookupStrategy")
- final Function<ProfileRequestContext, OIDCProviderMetadataContext> strategy)
- throws ComponentInitializationException {
-
- if (id == null && map == null) {
- throw new ComponentInitializationException("Must supply either a fixed client_id value or an "
- + "issuer to client_id map");
- }
- if (map != null) {
- issuerToClientIdMap = Collections.unmodifiableMap(map);
- } else {
- issuerToClientIdMap = Collections.emptyMap();
- }
- clientId = StringSupport.trimOrNull(id);
- providerMetadataLookupStrategy =
- Constraint.isNotNull(strategy, "The provider metadata lookup strategy can not be null");
- }
-
- @Override
- @Nullable public String apply(@Nonnull final ProfileRequestContext profileRequestContext) {
-
- // Use supplied client_id first
- if (clientId != null) {
- return clientId;
- } else {
- final OIDCProviderMetadataContext providerMetadataContext =
- providerMetadataLookupStrategy.apply(profileRequestContext);
- if (providerMetadataContext == null || providerMetadataContext.getProviderInformation() == null) {
- return null;
- }
-
- if (issuerToClientIdMap != null) {
- //Should not be if we get here.
- return issuerToClientIdMap.get(providerMetadataContext.getProviderInformation().getIssuer().getValue());
- }
- }
- return null;
- }
-
-}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/DefaultClientSecretLookupStrategy.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/DefaultClientSecretLookupStrategy.java
deleted file mode 100644
index f3d3f66..0000000
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/DefaultClientSecretLookupStrategy.java
+++ /dev/null
@@ -1,146 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.authn.oidc.rp.config;
-
-import java.nio.charset.StandardCharsets;
-import java.util.Collections;
-import java.util.Map;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-import javax.annotation.concurrent.ThreadSafe;
-
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.profile.context.navigate.OutboundMessageContextLookup;
-
-import net.shibboleth.idp.plugin.authn.oidc.rp.context.OAuth2ClientContext;
-import net.shibboleth.idp.plugin.authn.oidc.rp.context.OIDCPeerEntityContext;
-import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
-import net.shibboleth.utilities.java.support.component.AbstractIdentifiableInitializableComponent;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-import net.shibboleth.utilities.java.support.component.ComponentSupport;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.primitive.StringSupport;
-
-/**
- * A strategy that produces a client_secret either directly from the one supplied, or derived from the
- * lookup strategy.
- */
-//TODO secret could be private key
- at ThreadSafe
-public class DefaultClientSecretLookupStrategy extends AbstractIdentifiableInitializableComponent
- implements Function<ProfileRequestContext, String> {
-
- /**
- * A fixed client_secret to use over any injected strategy to locate one.
- * Must be UTF-8 encoded.
- */
- @Nullable private String clientSecret;
-
- /** The strategy used to lookup or create the {@link OAuth2ClientContext}.*/
- @Nonnull private Function<ProfileRequestContext, OAuth2ClientContext> oauth2ClientContextLookupStrategy;
-
- /** Map of client_id to client_secret. Can be {@literal null} if a fixed client_id are secret are used.*/
- @Nullable @NotLive private Map<String, String> clientIdToClientSecretMap;
-
- /**
- * Constructor.
- */
- public DefaultClientSecretLookupStrategy() {
- oauth2ClientContextLookupStrategy = new ChildContextLookup<>(OAuth2ClientContext.class).compose(
- new ChildContextLookup<>(OIDCPeerEntityContext.class).compose(
- new OutboundMessageContextLookup()));
- }
-
- @Override
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
-
- if (clientSecret == null && clientIdToClientSecretMap == null) {
- throw new ComponentInitializationException("Must supply either a fixed client_secret or a "
- + "client_id to client_secret map");
- }
- }
-
- /**
- * Set the client_id to client_secret map.
- *
- * @param map the map of client_id to client_secret details
- */
- public void setClientIdToClientSecretMap(@Nullable final Map<String, String> map) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
-
- if (map == null) {
- clientIdToClientSecretMap = Collections.emptyMap();
- } else {
- clientIdToClientSecretMap = Collections.unmodifiableMap(map);
- }
- }
-
- /**
- * Set the strategy to lookup the {@link OAuth2ClientContext}
- * from the {@link ProfileRequestContext}.
- *
- * @param strgy the strategy.
- */
- public void setOAuth2ClientContextLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, OAuth2ClientContext> strgy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
-
- oauth2ClientContextLookupStrategy = Constraint.isNotNull(strgy,
- "OAuth2 client context lookup strategy cannot be null");
- }
-
- /**
- * Set the client_secret. Must be UTF-8 encoded.
- *
- * @param secret the client_secret
- */
- public void setClientSecret(@Nullable final String secret) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
-
- clientSecret = secret;
- }
-
- @Override
- @Nullable public String apply(@Nonnull final ProfileRequestContext profileRequestContext) {
-
- // Use supplied client_id first
- if (clientSecret != null) {
- return clientSecret;
- }
- // Else pull it from the map
- final OAuth2ClientContext clientCtx = oauth2ClientContextLookupStrategy.apply(profileRequestContext);
- if (clientCtx == null || StringSupport.trimOrNull(clientCtx.getClientId()) == null) {
- return null;
- }
- final String secret =
- clientIdToClientSecretMap.get(clientCtx.getClientId());
-
- if (secret!= null && secret.length() > 0) {
- return secret;
- }
- return null;
- }
-
-}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/MapBackedMemoryStorageServiceFactoryBean.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/MapBackedMemoryStorageServiceFactoryBean.java
deleted file mode 100644
index 6cd60a9..0000000
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/MapBackedMemoryStorageServiceFactoryBean.java
+++ /dev/null
@@ -1,129 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.authn.oidc.rp.config;
-
-import java.util.Collections;
-import java.util.Map;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-import javax.annotation.concurrent.GuardedBy;
-import javax.annotation.concurrent.ThreadSafe;
-
-import org.opensaml.storage.StorageService;
-import org.opensaml.storage.impl.MemoryStorageService;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.springframework.beans.factory.config.AbstractFactoryBean;
-
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.fasterxml.jackson.databind.ObjectWriter;
-
-import net.shibboleth.utilities.java.support.annotation.ParameterName;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-
-/**
- * A factory that creates and populates a map backed {@link MemoryStorageService} from an injected map.
- * Values which are *not* Strings are serialized into JSON using the supplied object mapper before they are added
- * to the storage service. Values which are already Strings are just passed in without modification.
- */
- at ThreadSafe
- at Deprecated
-public class MapBackedMemoryStorageServiceFactoryBean extends AbstractFactoryBean<StorageService> {
-
- /** Class logger. */
- private final Logger log = LoggerFactory.getLogger(MapBackedMemoryStorageServiceFactoryBean.class);
-
- /** The Map to inject values into the storage service with.*/
- @Nonnull private final Map<String, Object> mapToInject;
-
- /** The ID to give the created memory service.*/
- @Nonnull private final String identifier;
-
- /** The partition name to use in the storage service.*/
- @Nonnull private final String storageServiceContext;
-
- /** JSON object mapper. */
- @Nonnull @GuardedBy("this") private ObjectMapper objectMapper;
-
- /**
- *
- * Constructor.
- *
- * @param map the issuer to client_id map to base the storage service off
- * @param id The ID to give the created memory service
- * @param context The partition name to use in the injected storage service
- */
- public MapBackedMemoryStorageServiceFactoryBean(@ParameterName(name="context") @Nonnull final String context,
- @ParameterName(name="map") @Nullable final Map<String, Object> map,
- @ParameterName(name="id") @Nonnull final String id) {
- if (map == null) {
- mapToInject = Collections.emptyMap();
- } else {
- mapToInject = Collections.unmodifiableMap(map);
- }
- identifier = Constraint.isNotEmpty(id, "Memory storage service must have an ID");
- storageServiceContext = Constraint.isNotEmpty(context, "Storage service context can not be null");
- setObjectMapper(new ObjectMapper());
- }
-
- /**
- * Set the JSON object mapper to use to convert the client authentication details to a JSON string.
- *
- * @param mapper the object mapper
- */
- public synchronized void setObjectMapper(@Nonnull final ObjectMapper mapper) {
- objectMapper = Constraint.isNotNull(mapper, "Object mapper can not be null");
- }
-
- /**
- * Get the JSON object mapper.
- *
- * @return the object mapper
- */
- private synchronized ObjectMapper getObjectMapper() {
- return objectMapper;
- }
-
- @Override
- public Class<?> getObjectType() {
- return StorageService.class;
- }
-
- @Override
- protected StorageService createInstance() throws Exception {
- final MemoryStorageService service = new MemoryStorageService();
- service.setId(identifier);
- service.initialize();
- // One writer for all records, is safe.
- final ObjectWriter ow = getObjectMapper().writer();
- for (final Map.Entry<String, Object> entry : mapToInject.entrySet()) {
- String objectAsString = null;
- if (entry.getValue() instanceof String) {
- objectAsString = (String) entry.getValue();
- } else {
- objectAsString = ow.writeValueAsString(entry.getValue());
- }
- service.create(storageServiceContext, entry.getKey(), objectAsString, null);
- }
- log.debug("Created a map based memory storage service '{}' with '{}' records",
- identifier, mapToInject.size());
- return service;
- }
-
-}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/decoding/impl/DefaultMapResponseDecoder.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/decoding/impl/DefaultMapResponseDecoder.java
index 19d0363..b1963fb 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/decoding/impl/DefaultMapResponseDecoder.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/decoding/impl/DefaultMapResponseDecoder.java
@@ -30,7 +30,7 @@ import org.slf4j.LoggerFactory;
import com.fasterxml.jackson.core.type.TypeReference;
import com.nimbusds.jose.util.IOUtils;
-/** Default token response decoder, which converts a succesful HTTP response into an Map.*/
+/** Default token response decoder, which converts a successful HTTP response into an Map.*/
public class DefaultMapResponseDecoder extends AbstractJSONResponseDecoderFunction<Map<String, Object>> {
/** Class logger. */
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/encoding/impl/DefaultAuthCodeTokenRequestEncoder.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/encoding/impl/DefaultAuthCodeTokenRequestEncoder.java
index c5c4b33..526956e 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/encoding/impl/DefaultAuthCodeTokenRequestEncoder.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/encoding/impl/DefaultAuthCodeTokenRequestEncoder.java
@@ -40,6 +40,7 @@ import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
/** A token request encoder that builds an OAuth2.0 Access Token Request for an authorization code grant request. */
//TODO either only applies to authorization_code grant, or can handle more. If specific, must gurantee that.
//TODO just remove in favour of the Nimbus version?
+ at Deprecated
public class DefaultAuthCodeTokenRequestEncoder extends AbstractRequestEncoderFunction {
/** The HTTPS scheme.*/
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AbstractOIDCAuthenticationRequestMessageHandler.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AbstractOIDCAuthenticationRequestMessageHandler.java
index d56dab5..3be7355 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AbstractOIDCAuthenticationRequestMessageHandler.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AbstractOIDCAuthenticationRequestMessageHandler.java
@@ -44,7 +44,7 @@ public abstract class AbstractOIDCAuthenticationRequestMessageHandler extends Ab
@Nonnull
private Function<MessageContext, OutboundMessageHandlerContext> outboundMessageHandlerContextLookupStrategy;
- /** Strategy used to locate the {@link OIDCAuthenticationRequest} to sign. */
+ /** Strategy used to locate the {@link OIDCAuthenticationRequest}. */
@Nonnull private Function<MessageContext, OIDCAuthenticationRequest> authenticationRequestLookupStrategy;
/** The stashed {@link OutboundMessageHandlerContext}.*/
@@ -64,7 +64,6 @@ public abstract class AbstractOIDCAuthenticationRequestMessageHandler extends Ab
return null;
};
}
-
/**
* Set the strategy used to locate the {@link OIDCAuthenticationRequest} to use.
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddState.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddState.java
index 579c441..2df4d73 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddState.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddState.java
@@ -34,7 +34,11 @@ import net.shibboleth.idp.plugin.authn.oidc.rp.impl.OIDCProxySupport;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
-/** Add state to the authentication request URL and the request object claims (if present) .*/
+/**
+ * Add state to the authentication request URL and the request object claims (if present).
+ * By default this is generated by concatenating the Hex value of the spring webflow execution
+ * key with a secure random 32 character nonce.
+ * */
public class AddState extends AbstractOIDCAuthenticationRequestMessageHandler {
/** The 'state' claim name.*/
@@ -87,11 +91,11 @@ public class AddState extends AbstractOIDCAuthenticationRequestMessageHandler {
@Override
protected void doInvoke(@Nonnull final MessageContext messageContext) throws MessageHandlerException {
- final String stateString = stateGenerationStrategy.apply(messageContext);
- log.trace("{} Generated state '{}'", getLogPrefix(), stateString);
+ final String stateString = stateGenerationStrategy.apply(messageContext);
if (stateString == null) {
throw new MessageHandlerException("Generated state was null");
}
+ log.trace("{} Generated state '{}'", getLogPrefix(), stateString);
final State state = new State(stateString);
// Add to outer request
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/EncryptJWT.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/EncryptJWT.java
index a987490..1066b65 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/EncryptJWT.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/EncryptJWT.java
@@ -53,6 +53,7 @@ import net.shibboleth.oidc.security.JWTEncryptionParameters;
import net.shibboleth.oidc.security.context.JWTSecurityParametersContext;
import net.shibboleth.oidc.security.impl.CredentialConversionUtil;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
@@ -63,6 +64,7 @@ import net.shibboleth.utilities.java.support.primitive.StringSupport;
* {@link JWTSecurityParametersContext}. The {@link Payload} to encrypt is determined by lookup strategy.
* A consumer takes the {@link EncryptedJWT} and updates the correct object in the {@link MessageContext}.
*/
+//TODO encrypt action is unpleasent to look at
public class EncryptJWT extends AbstractMessageHandler {
/** Class logger. */
@@ -80,12 +82,28 @@ public class EncryptJWT extends AbstractMessageHandler {
/** The signature signing parameters. */
@Nullable private JWTEncryptionParameters encryptionParameters;
+ /** A friendly name to log as the subject of encryption parameter resolution.*/
+ @Nonnull private String forFriendlyName;
+
/** Constructor.*/
- public EncryptJWT() {
+ public EncryptJWT() {
+ forFriendlyName = "not-specified";
securityParametersLookupStrategy = new ChildContextLookup<>(JWTSecurityParametersContext.class);
}
+ /**
+ * Set the friendly name to log as the subject of encryption.
+ *
+ * @param name the friendly name
+ */
+ public void setForFriendlyName(@Nonnull @NotEmpty final String name) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+ ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
+
+ forFriendlyName = Constraint.isNotEmpty(name, "ForFriendlyName can not be null or empty");
+ }
+
/**
* Set the consumer used to update the MessageContext with the supplied EncryptedJWT.
*
@@ -203,8 +221,8 @@ public class EncryptJWT extends AbstractMessageHandler {
jweObject = new JWEObject(new JWEHeader.Builder(encAlg, encEnc).contentType("JWT")
.keyID(keyTransportKid).build(), payload);
- log.debug("{} Encrypting with kid '{}' and params alg: {} enc: {}",
- getLogPrefix(), keyTransportKid, encAlg.getName(), encEnc.getName());
+ log.debug("{} Encrypting '{}' with kid '{}' and params alg: {} enc: {}",
+ getLogPrefix(), forFriendlyName, keyTransportKid, encAlg.getName(), encEnc.getName());
jweObject.encrypt(new RSAEncrypter((RSAPublicKey) keyTransportCredential.getPublicKey()));
} else if (JWEAlgorithm.Family.ECDH_ES.contains(encAlg) && keyTransportCredential != null &&
@@ -212,8 +230,8 @@ public class EncryptJWT extends AbstractMessageHandler {
jweObject = new JWEObject(new JWEHeader.Builder(encAlg, encEnc).contentType("JWT")
.keyID(keyTransportKid).build(), payload);
- log.debug("{} Encrypting with kid '{}' and params alg: {} enc: {}",
- getLogPrefix(), keyTransportKid, encAlg.getName(), encEnc.getName());
+ log.debug("{} Encrypting '{}' with kid '{}' and params alg: {} enc: {}",
+ getLogPrefix(), forFriendlyName, keyTransportKid, encAlg.getName(), encEnc.getName());
jweObject.encrypt(new ECDHEncrypter((ECPublicKey) keyTransportCredential.getPublicKey()));
} else if ((JWEAlgorithm.Family.AES_KW.contains(encAlg) || JWEAlgorithm.Family.AES_GCM_KW.contains(encAlg))
@@ -221,8 +239,9 @@ public class EncryptJWT extends AbstractMessageHandler {
jweObject = new JWEObject(new JWEHeader.Builder(encAlg, encEnc).contentType("JWT")
.keyID(keyTransportKid).build(), payload);
- log.debug("{} Encrypting with kid '{}' and params alg: {} enc: {}",
- getLogPrefix(), keyTransportKid, encAlg.getName(), encEnc.getName());
+ log.debug("{} Encrypting '{}' with kid '{}' and params alg: {} enc: {}",
+ getLogPrefix(), forFriendlyName, keyTransportKid, encAlg.getName(),
+ encEnc.getName());
jweObject.encrypt(new AESEncrypter(keyTransportCredential.getSecretKey()));
} else if (JWEAlgorithm.DIR.equals(encAlg) && dataEncryptionCredential != null &&
@@ -230,8 +249,8 @@ public class EncryptJWT extends AbstractMessageHandler {
jweObject = new JWEObject(new JWEHeader.Builder(encAlg, encEnc).contentType("JWT")
.keyID(dataEncryptionKid).build(), payload);
- log.debug("{} Encrypting with kid '{}' and params alg: {} enc: {}",
- getLogPrefix(), dataEncryptionKid, encAlg.getName(), encEnc.getName());
+ log.debug("{} Encrypting '{}' with kid '{}' and params alg: {} enc: {}",
+ getLogPrefix(), forFriendlyName, dataEncryptionKid, encAlg.getName(), encEnc.getName());
jweObject.encrypt(new DirectEncrypter(dataEncryptionCredential.getSecretKey()));
} else {
@@ -244,9 +263,9 @@ public class EncryptJWT extends AbstractMessageHandler {
jwtUpdateConsumer.accept(encryptedJWT, messageContext);
if (log.isDebugEnabled() && !log.isTraceEnabled()) {
- log.debug("{} Encrypted RequestObject", getLogPrefix());
+ log.debug("{} Encrypted '{}' JWT", getLogPrefix(), forFriendlyName);
} else if (log.isTraceEnabled()) {
- log.debug("{} Encrypted RequestObject: {}", getLogPrefix(), encryptedJWT.serialize());
+ log.debug("{} Encrypted '{}' JWT: {}", getLogPrefix(), forFriendlyName, encryptedJWT.serialize());
}
} catch (final Exception e) {
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/SignRequestObject.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/SignJWT.java
similarity index 90%
rename from idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/SignRequestObject.java
rename to idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/SignJWT.java
index 26fd3e5..f0b30aa 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/SignRequestObject.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/SignJWT.java
@@ -62,10 +62,10 @@ import net.shibboleth.utilities.java.support.primitive.StringSupport;
* Action that signs a request object and sets it as the request object to the authentication request.
*/
//TODO move to commons?
-public class SignRequestObject extends AbstractMessageHandler {
+public class SignJWT extends AbstractMessageHandler {
/** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(SignRequestObject.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(SignJWT.class);
/** Strategy used to locate the {@link SecurityParametersContext} to use for signing. */
@Nonnull private Function<MessageContext, JWTSecurityParametersContext> securityParametersLookupStrategy;
@@ -88,11 +88,27 @@ public class SignRequestObject extends AbstractMessageHandler {
/** "typ" header to insert while signing. */
@Nullable @NotEmpty private String typeHeader;
+ /** A friendly name to log as the subject of encryption parameter resolution.*/
+ @Nonnull private String forFriendlyName;
+
/** Constructor.*/
- public SignRequestObject() {
+ public SignJWT() {
+ forFriendlyName = "not-specified";
securityParametersLookupStrategy = new ChildContextLookup<>(JWTSecurityParametersContext.class);
}
+ /**
+ * Set the friendly name to log as the subject of signing.
+ *
+ * @param name the friendly name
+ */
+ public void setForFriendlyName(@Nonnull @NotEmpty final String name) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+ ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
+
+ forFriendlyName = Constraint.isNotEmpty(name, "ForFriendlyName can not be null or empty");
+ }
+
@Override
protected void doInitialize() throws ComponentInitializationException {
if (claimsToSignLookupStrategy == null) {
@@ -177,7 +193,7 @@ public class SignRequestObject extends AbstractMessageHandler {
jwtClaimSetToSign = claimsToSignLookupStrategy.apply(messageContext);
if (jwtClaimSetToSign == null) {
- log.debug("{} No JWT ClaimsSet for RequestObject, nothing to sign", getLogPrefix());
+ log.debug("{} No JWT ClaimsSet, nothing to sign", getLogPrefix());
return false;
}
@@ -202,15 +218,15 @@ public class SignRequestObject extends AbstractMessageHandler {
jwt = new SignedJWT(headerBuilder.build(), jwtClaimSetToSign);
jwt.sign(signer);
if (log.isDebugEnabled() && !log.isTraceEnabled()) {
- log.debug("{} Signed RequestObject", getLogPrefix());
+ log.debug("{} Signed JWT '{}'", getLogPrefix(), forFriendlyName);
} else if (log.isTraceEnabled()) {
- log.debug("{} Signed RequestObject: {}", getLogPrefix(), jwt.serialize());
+ log.debug("{} Signed JWT '{}': {}", getLogPrefix(), forFriendlyName, jwt.serialize());
}
if (jwt.getState() != State.SIGNED) {
// Should not really happen, as JOSEException should be thrown
- log.error("{} RequestObject was not signed", getLogPrefix());
- throw new MessageHandlerException("RequestObject was not signed, unknown cause");
+ log.error("{} JWT '{}' was not signed", getLogPrefix(), forFriendlyName);
+ throw new MessageHandlerException("JWT was not signed, unknown cause");
}
// Update to the signed JWT
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/metadata/impl/DefaultClientIDForIssuerLookupFunction.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/metadata/impl/DefaultClientIDForIssuerLookupFunction.java
index b381298..ecaef4b 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/metadata/impl/DefaultClientIDForIssuerLookupFunction.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/metadata/impl/DefaultClientIDForIssuerLookupFunction.java
@@ -1,3 +1,20 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
package net.shibboleth.idp.plugin.authn.oidc.rp.metadata.impl;
import java.util.Collections;
@@ -19,7 +36,7 @@ import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElemen
/**
- * Strategy to pull out the ID of the OIDC Client registered with to talk to the discovered/configured OP.
+ * Strategy to pull out the ID of the OIDC Client registered to talk to the discovered/configured OP.
*/
public class DefaultClientIDForIssuerLookupFunction implements ContextDataLookupFunction<MessageContext, ClientID> {
@@ -38,13 +55,14 @@ public class DefaultClientIDForIssuerLookupFunction implements ContextDataLookup
issuerToClientMap = Collections.emptyMap();
} else {
issuerToClientMap = new HashMap<>(map.size());
- for (Map.Entry<String, String> entry : map.entrySet()) {
+ for (final Map.Entry<String, String> entry : map.entrySet()) {
issuerToClientMap.put(new Issuer(entry.getKey()), new ClientID(entry.getValue()));
}
}
}
/** {@inheritDoc} */
+ @Override
@Nullable public ClientID apply(@Nullable final MessageContext input) {
if (input == null) {
return null;
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/metadata/impl/DefaultIssuerIDLookupFunction.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/metadata/impl/DefaultIssuerIDLookupFunction.java
index 4e9bed0..2456bbd 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/metadata/impl/DefaultIssuerIDLookupFunction.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/metadata/impl/DefaultIssuerIDLookupFunction.java
@@ -1,3 +1,20 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
package net.shibboleth.idp.plugin.authn.oidc.rp.metadata.impl;
import javax.annotation.Nullable;
@@ -15,6 +32,7 @@ import net.shibboleth.idp.plugin.authn.oidc.rp.context.OIDCPeerEntityContext;
public class DefaultIssuerIDLookupFunction implements ContextDataLookupFunction<MessageContext, String> {
/** {@inheritDoc} */
+ @Override
@Nullable public String apply(@Nullable final MessageContext input) {
if (input == null) {
return null;
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/metadata/impl/FilesystemClientInformationResolver.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/metadata/impl/FilesystemClientInformationResolver.java
deleted file mode 100644
index 524ab13..0000000
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/metadata/impl/FilesystemClientInformationResolver.java
+++ /dev/null
@@ -1,171 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.authn.oidc.rp.metadata.impl;
-
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Iterator;
-import java.util.List;
-import java.util.Timer;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.springframework.core.io.Resource;
-
-import com.nimbusds.oauth2.sdk.ParseException;
-import com.nimbusds.oauth2.sdk.id.Issuer;
-import com.nimbusds.oauth2.sdk.util.JSONArrayUtils;
-import com.nimbusds.oauth2.sdk.util.JSONObjectUtils;
-import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
-
-import net.minidev.json.JSONArray;
-import net.minidev.json.JSONObject;
-import net.shibboleth.oidc.metadata.RefreshableClientInformationResolver;
-import net.shibboleth.oidc.metadata.criterion.IssuerIDCriterion;
-import net.shibboleth.oidc.metadata.impl.AbstractFileOIDCEntityResolver;
-import net.shibboleth.utilities.java.support.annotation.ParameterName;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-import net.shibboleth.utilities.java.support.component.ComponentSupport;
-import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
-import net.shibboleth.utilities.java.support.resolver.ResolverException;
-
-/**
- * A client metadata provider that pulls metadata from a file on the local filesystem.
- *
- * <p>The client information returned is determined from the 'issuer' custom claim.</p>
- *
- */
-public class FilesystemClientInformationResolver extends AbstractFileOIDCEntityResolver<Issuer, OIDCClientInformation>
- implements RefreshableClientInformationResolver {
-
- /** Class logger. */
- private final Logger log = LoggerFactory.getLogger(FilesystemClientInformationResolver.class);
-
- /**
- * Constructor.
- *
- * @param metadata the metadata file
- *
- * @throws IOException If the metedata cannot be loaded.
- */
- public FilesystemClientInformationResolver(
- @Nonnull @ParameterName(name="metadata") final Resource metadata) throws IOException {
- super(metadata);
- }
-
- /**
- * Constructor.
- *
- * @param metadata the metadata file
- * @param backgroundTaskTimer timer used to refresh metadata in the background
- *
- * @throws IOException If the metedata cannot be loaded.
- */
- public FilesystemClientInformationResolver(@Nullable final Timer backgroundTaskTimer,
- @Nonnull final Resource metadata) throws IOException {
- super(backgroundTaskTimer, metadata);
- }
-
- /** {@inheritDoc} */
- @Override protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
- }
-
- /** {@inheritDoc} */
- @Override
- public Iterable<OIDCClientInformation> resolve(final CriteriaSet criteria) throws ResolverException {
- ComponentSupport.ifNotInitializedThrowUninitializedComponentException(this);
- ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
-
- final IssuerIDCriterion issuerIdCriterion = criteria.get(IssuerIDCriterion.class);
- if (issuerIdCriterion == null || issuerIdCriterion.getIssuerID() == null) {
- log.trace("No issuer ID criteria found, returning all");
- return updateKeys(getBackingStore().getOrderedInformation());
- }
- // TODO: support other criterion
- return updateKeys(lookupIdentifier(issuerIdCriterion.getIssuerID()));
- }
-
- /**
- * Updates the key set in the given list of OIDC client informations. The configured remote JWK set cache is
- * exploited.
- *
- * @param clientInformations The OIDC client informations whose keys are going to be updated.
- *
- * @return The OIDC client informations, containing contents of getJWKSetURI() in getJWKSet().
- */
- protected List<OIDCClientInformation> updateKeys(final List<OIDCClientInformation> clientInformations) {
- final List<OIDCClientInformation> result = new ArrayList<>();
- for (final OIDCClientInformation clientInformation : clientInformations) {
- result.add(clientInformation);
- }
- return result;
- }
-
- /** {@inheritDoc} */
- @Override
- public OIDCClientInformation resolveSingle(@Nullable final CriteriaSet criteria) throws ResolverException {
- final Iterable<OIDCClientInformation> iterable = resolve(criteria);
- if (iterable != null) {
- final Iterator<OIDCClientInformation> iterator = iterable.iterator();
- if (iterator != null && iterator.hasNext()) {
- return iterator.next();
- }
- }
- log.warn("Could not find any clients with the given criteria");
- return null;
- }
-
- /** {@inheritDoc} */
- @Override
- protected List<OIDCClientInformation> parse(@Nonnull final byte[] bytes) throws ParseException {
- final String rawString = new String(bytes);
- try {
- final OIDCClientInformation single = OIDCClientInformation.parse(JSONObjectUtils.parse(rawString));
- log.debug("Found single client information from the file");
- return Arrays.asList(single);
- } catch (final ParseException e) {
- log.debug("Could not parse single client information from the file, checking for array");
- }
- try {
- final JSONArray parsedArray = JSONArrayUtils.parse(rawString);
- final List<OIDCClientInformation> result = new ArrayList<OIDCClientInformation>();
- for (final Object object : parsedArray) {
- final OIDCClientInformation client = OIDCClientInformation.parse((JSONObject) object);
- result.add(client);
- }
- return result;
- } catch (final ParseException e) {
- throw new ParseException("Could not parse a single or an array of OIDC client information object(s).");
- }
- }
-
- /** {@inheritDoc} */
- @Override
- protected Issuer getKey(@Nonnull final OIDCClientInformation value) {
- final Object issuerObject = value.getMetadata().getCustomField("issuer");
- if (issuerObject instanceof String) {
- return new Issuer((String)issuerObject);
- }
- throw new IllegalArgumentException("Client information metadata does not contain an issuer");
- }
-}
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
index 02d81c7..a0f7060 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
@@ -276,7 +276,8 @@
scope="prototype" />
<bean id="SignRequestObject"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.SignRequestObject" scope="prototype">
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.SignJWT" scope="prototype"
+ p:forFriendlyName="RequestObject">
<property name="claimsToSignLookupStrategy">
<bean class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic.JWTClaimsSetFromRequestObjectLookupFunction"/>
</property>
@@ -286,7 +287,8 @@
</bean>
<bean id="EncryptRequestObject"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.EncryptJWT" scope="prototype">
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.EncryptJWT" scope="prototype"
+ p:forFriendlyName="RequestObject">
<property name="payloadToEncryptLookupStrategy">
<bean class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic.PayloadFromRequestObjectLookupFunction"/>
</property>
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index 34fd4a9..936df83 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -106,8 +106,8 @@
<property name="keyTransportEncryptionAlgorithms">
<list>
<!-- TODO move this KW back to original order -->
- <!-- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_DIR" /> -->
+ <!-- <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_DIR" /> -->
<util:constant
static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_RSA_1_5" />
<util:constant
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/DefaultClientAuthenticationLookupStrategyTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/DefaultClientAuthenticationLookupStrategyTest.java
deleted file mode 100644
index 50359d5..0000000
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/DefaultClientAuthenticationLookupStrategyTest.java
+++ /dev/null
@@ -1,188 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.authn.oidc.rp.config;
-
-import static org.testng.Assert.assertEquals;
-import static org.testng.Assert.assertFalse;
-import static org.testng.Assert.assertNull;
-import static org.testng.Assert.assertTrue;
-
-import java.time.Duration;
-import java.time.Instant;
-import java.util.Map;
-
-import org.opensaml.messaging.context.MessageContext;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.testng.annotations.Test;
-
-import com.nimbusds.oauth2.sdk.auth.ClientAuthentication;
-import com.nimbusds.oauth2.sdk.auth.ClientSecretBasic;
-import com.nimbusds.oauth2.sdk.auth.ClientSecretPost;
-
-import net.shibboleth.idp.plugin.authn.oidc.rp.context.OAuth2ClientContext;
-import net.shibboleth.idp.plugin.authn.oidc.rp.context.OIDCPeerEntityContext;
-import net.shibboleth.idp.plugin.authn.oidc.rp.storage.ClientAuthenticationDetails;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-
-/** Tests for the DefaultClientAuthenticationLookupStrategy.*/
-public class DefaultClientAuthenticationLookupStrategyTest {
-
- /** Strategy to test.*/
- private DefaultClientAuthenticationLookupStrategy strategy;
-
- @Test
- public void testBuildFromProperties() throws ComponentInitializationException {
- strategy = new DefaultClientAuthenticationLookupStrategy();
- strategy.setClientId("client_id");
- strategy.setClientSecret("client_secret".toCharArray());
- strategy.setClientSecretExpiresAt(Duration.ofSeconds(0));
- strategy.setClientAuthenticationMethod("client_secret_basic");
- strategy.setId("MockAuthenticationLookupStrategy");
- strategy.initialize();
-
- final ClientAuthentication clientAuth = strategy.apply(new ProfileRequestContext());
- assertEquals(clientAuth.getClientID().getValue(), "client_id");
- assertTrue(clientAuth instanceof ClientSecretBasic);
- assertEquals(((ClientSecretBasic)clientAuth).getClientSecret().getValue(), "client_secret");
- assertFalse(((ClientSecretBasic)clientAuth).getClientSecret().expired());
- }
-
- @Test(expectedExceptions = ComponentInitializationException.class)
- public void testInitialisationFailed() throws ComponentInitializationException {
- strategy = new DefaultClientAuthenticationLookupStrategy();
- strategy.setId("MockAuthenticationLookupStrategy");
- strategy.initialize();
- }
-
- @Test
- public void testBuildFromProperties_SecretExpired() throws ComponentInitializationException {
- strategy = new DefaultClientAuthenticationLookupStrategy();
- strategy.setClientId("client_id");
- strategy.setClientSecret("client_secret".toCharArray());
- strategy.setClientSecretExpiresAt(Duration.ofSeconds(1));
- strategy.setClientAuthenticationMethod("client_secret_basic");
- strategy.setId("MockAuthenticationLookupStrategy");
- strategy.initialize();
-
- final ClientAuthentication clientAuth = strategy.apply(new ProfileRequestContext());
- assertNull(clientAuth);
- }
-
- @Test
- public void testBuildFromMap() throws ComponentInitializationException {
- strategy = new DefaultClientAuthenticationLookupStrategy();
- strategy.setClientIdToClientAuthenticationMap(
- Map.of("client_id",
- new ClientAuthenticationDetails("client_secret".toCharArray(), 0, "client_secret_post")));
- strategy.setId("MockAuthenticationLookupStrategy");
- strategy.initialize();
-
- final var prc = new ProfileRequestContext();
- final var outBnd = new MessageContext();
- final var clientContext = outBnd.getSubcontext(OIDCPeerEntityContext.class, true)
- .getSubcontext(OAuth2ClientContext.class,true);
- clientContext.setClientId("client_id");
- prc.setOutboundMessageContext(outBnd);
-
- final ClientAuthentication clientAuth = strategy.apply(prc);
- assertEquals(clientAuth.getClientID().getValue(), "client_id");
- assertTrue(clientAuth instanceof ClientSecretPost);
- assertEquals(((ClientSecretPost)clientAuth).getClientSecret().getValue(), "client_secret");
- assertFalse(((ClientSecretPost)clientAuth).getClientSecret().expired());
- }
-
- @Test
- public void testBuildFromStrategy_PartialClientProperties() throws ComponentInitializationException {
- strategy = new DefaultClientAuthenticationLookupStrategy();
- strategy.setClientId("client_id_static");
- strategy.setClientSecret("client_secret_static".toCharArray());
- strategy.setClientSecretExpiresAt(null);
- strategy.setClientAuthenticationMethod(null);
- strategy.setClientIdToClientAuthenticationMap(
- Map.of("client_id",
- new ClientAuthenticationDetails("client_secret".toCharArray(), 0, "client_secret_post")));
- strategy.setId("MockAuthenticationLookupStrategy");
- strategy.initialize();
-
- final var prc = new ProfileRequestContext();
- final var outBnd = new MessageContext();
- final var clientContext = outBnd.getSubcontext(OIDCPeerEntityContext.class, true)
- .getSubcontext(OAuth2ClientContext.class,true);
- clientContext.setClientId("client_id");
- prc.setOutboundMessageContext(outBnd);
-
- final ClientAuthentication clientAuth = strategy.apply(prc);
- assertEquals(clientAuth.getClientID().getValue(), "client_id");
- assertTrue(clientAuth instanceof ClientSecretPost);
- assertEquals(((ClientSecretPost)clientAuth).getClientSecret().getValue(), "client_secret");
- assertFalse(((ClientSecretPost)clientAuth).getClientSecret().expired());
- }
-
- @Test
- public void testBuildFromStrategy_PartialClientProperties_ExpiredSecret() throws ComponentInitializationException {
- strategy = new DefaultClientAuthenticationLookupStrategy();
- strategy.setClientId("client_id_static");
- strategy.setClientSecret("client_secret_static".toCharArray());
- strategy.setClientSecretExpiresAt(null);
- strategy.setClientAuthenticationMethod(null);
- strategy.setClientIdToClientAuthenticationMap(
- Map.of("client_id",
- new ClientAuthenticationDetails("client_secret".toCharArray(), 1, "client_secret_post")));
- strategy.setId("MockAuthenticationLookupStrategy");
- strategy.initialize();
-
- final var prc = new ProfileRequestContext();
- final var outBnd = new MessageContext();
- final var clientContext = outBnd.getSubcontext(OIDCPeerEntityContext.class, true)
- .getSubcontext(OAuth2ClientContext.class,true);
- clientContext.setClientId("client_id");
- prc.setOutboundMessageContext(outBnd);
- final ClientAuthentication clientAuth = strategy.apply(prc);
- assertNull(clientAuth);
- }
-
- @Test
- public void testBuildFromStrategy_PartialClientProperties_SecretNearlyExpired()
- throws ComponentInitializationException {
- strategy = new DefaultClientAuthenticationLookupStrategy();
- strategy.setClientId("client_id_static");
- strategy.setClientSecret("client_secret_static".toCharArray());
- strategy.setClientSecretExpiresAt(null);
- strategy.setClientAuthenticationMethod(null);
- strategy.setClientIdToClientAuthenticationMap(
- Map.of("client_id",
- new ClientAuthenticationDetails("client_secret".toCharArray(),
- Instant.now().plus(Duration.ofSeconds(10)).getEpochSecond(), "client_secret_post")));
- strategy.setId("MockAuthenticationLookupStrategy");
- strategy.initialize();
-
- final var prc = new ProfileRequestContext();
- final var outBnd = new MessageContext();
- final var clientContext = outBnd.getSubcontext(OIDCPeerEntityContext.class, true)
- .getSubcontext(OAuth2ClientContext.class,true);
- clientContext.setClientId("client_id");
- prc.setOutboundMessageContext(outBnd);
-
- final ClientAuthentication clientAuth = strategy.apply(prc);
- assertEquals(clientAuth.getClientID().getValue(), "client_id");
- assertTrue(clientAuth instanceof ClientSecretPost);
- assertEquals(((ClientSecretPost)clientAuth).getClientSecret().getValue(), "client_secret");
- assertFalse(((ClientSecretPost)clientAuth).getClientSecret().expired());
- }
-
-}
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthorizationControllerTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthorizationControllerTest.java
index 67986c3..fb47b43 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthorizationControllerTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthorizationControllerTest.java
@@ -93,7 +93,7 @@ import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic.PayloadFr
import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.AddState;
import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.BuildPlainRequestObjectJWT;
import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.EncryptJWT;
-import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.SignRequestObject;
+import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.SignJWT;
import net.shibboleth.idp.plugin.authn.test.flow.mock.IdPPropertyConfigurer;
import net.shibboleth.idp.session.IdPSession;
import net.shibboleth.idp.session.context.SessionContext;
@@ -284,7 +284,7 @@ public class AuthorizationControllerTest extends AbstractTestNGSpringContextTest
final var addState = new AddState();
addState.initialize();
- final var signer = new SignRequestObject();
+ final var signer = new SignJWT();
signer.setClaimsToSignLookupStrategy(new JWTClaimsSetFromRequestObjectLookupFunction());
signer.setJwtUpdateConsumer(new RequestObjectTokenUpdateStrategy());
signer.initialize();
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/SignRequestObjectTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/SignJWTTest.java
similarity index 97%
rename from idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/SignRequestObjectTest.java
rename to idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/SignJWTTest.java
index 1fde602..6041dab 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/SignRequestObjectTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/SignJWTTest.java
@@ -48,17 +48,17 @@ import net.shibboleth.oidc.security.JWTSignatureSigningParameters;
import net.shibboleth.oidc.security.context.JWTSecurityParametersContext;
/**
- * Tests for the SignRequestObject message handler.
+ * Tests for the SignJWT message handler.
*
* <p>Note, These tests sign a RequestObject. </p>
*/
-public class SignRequestObjectTest extends AbstractOIDCTest {
+public class SignJWTTest extends AbstractOIDCTest {
/** A client_secret to use.*/
@Nonnull private static final String CLIENT_SECRET = "Xp2s5v8y/B?E(H+MbQeThWmYq3t6w9z$";
/** The signer to test.*/
- private SignRequestObject signer;
+ private SignJWT signer;
/** The authn request.*/
private OIDCAuthenticationRequest request;
@@ -67,7 +67,7 @@ public class SignRequestObjectTest extends AbstractOIDCTest {
@BeforeMethod
public void setup() throws Exception {
super.setup();
- signer = new SignRequestObject();
+ signer = new SignJWT();
signer.setClaimsToSignLookupStrategy(mc -> {
final OIDCAuthenticationRequest ar = (OIDCAuthenticationRequest)mc.getMessage();
diff --git a/idp-oidc-rp-impl/src/test/resources/conf/authn/oidc-client-registration-authentication.xml b/idp-oidc-rp-impl/src/test/resources/conf/authn/oidc-client-registration-authentication.xml
deleted file mode 100644
index 667b19b..0000000
--- a/idp-oidc-rp-impl/src/test/resources/conf/authn/oidc-client-registration-authentication.xml
+++ /dev/null
@@ -1,28 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
- xmlns:context="http://www.springframework.org/schema/context"
- xmlns:util="http://www.springframework.org/schema/util" xmlns:p="http://www.springframework.org/schema/p"
- xmlns:c="http://www.springframework.org/schema/c" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-
- default-init-method="initialize" default-destroy-method="destroy">
-
-
- <!--
- Map clients to appropriate client authentication
- -->
-
- <util:map id="shibboleth.authn.oidc.rp.ClientIdToClientAuthenticationMap">
- <entry key="mytestclient">
- <bean parent="shibboleth.authn.oidc.rp.ClientAuthenticationDetails" c:clientSecret="myclientsecret"
- c:tokenEndpointAuthMethod="client_secret_basic" />
- </entry>
- <entry key="demo_rp">
- <bean parent="shibboleth.authn.oidc.rp.ClientAuthenticationDetails" c:clientSecret="myclientsecret"
- c:tokenEndpointAuthMethod="client_secret_basic" />
- </entry>
- </util:map>
-
-</beans>
\ No newline at end of file
diff --git a/idp-oidc-rp-impl/src/test/resources/conf/authn/oidc-client-registration-clientid.xml b/idp-oidc-rp-impl/src/test/resources/conf/authn/oidc-client-registration-clientid.xml
deleted file mode 100644
index d684f62..0000000
--- a/idp-oidc-rp-impl/src/test/resources/conf/authn/oidc-client-registration-clientid.xml
+++ /dev/null
@@ -1,21 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
- xmlns:context="http://www.springframework.org/schema/context"
- xmlns:util="http://www.springframework.org/schema/util" xmlns:p="http://www.springframework.org/schema/p"
- xmlns:c="http://www.springframework.org/schema/c" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-
- default-init-method="initialize" default-destroy-method="destroy">
-
- <!--
- Map issuers to appropriate clients
- -->
-
- <util:map id="shibboleth.authn.oidc.rp.IssuerToClientIdMap">
- <entry key="https://localhost:9918" value="mytestclient" />
- </util:map>
-
-
-</beans>
\ No newline at end of file
diff --git a/idp-oidc-rp-impl/src/test/resources/conf/authn/oidc-clientinfo-resolvers.xml b/idp-oidc-rp-impl/src/test/resources/conf/authn/oidc-clientinfo-resolvers.xml
deleted file mode 100644
index 99f54d9..0000000
--- a/idp-oidc-rp-impl/src/test/resources/conf/authn/oidc-clientinfo-resolvers.xml
+++ /dev/null
@@ -1,23 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
- xmlns:context="http://www.springframework.org/schema/context"
- xmlns:util="http://www.springframework.org/schema/util"
- xmlns:p="http://www.springframework.org/schema/p"
- xmlns:c="http://www.springframework.org/schema/c"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-
- default-init-method="initialize"
- default-destroy-method="destroy">
-
- <util:list id="shibboleth.oidc.ClientInformationResolvers">
- <ref bean="ExampleFileResolver" />
- </util:list>
-
- <bean id="ExampleFileResolver"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.metadata.impl.FilesystemClientInformationResolver" p:id="ExampleFileResolver1"
- c:metadata="metadata/oidc-clients.json"/>
-
-</beans>
\ No newline at end of file
diff --git a/idp-oidc-rp-impl/src/test/resources/conf/authn/rp-credentials.xml b/idp-oidc-rp-impl/src/test/resources/conf/authn/rp-credentials.xml
index 9817820..b3e52af 100644
--- a/idp-oidc-rp-impl/src/test/resources/conf/authn/rp-credentials.xml
+++ b/idp-oidc-rp-impl/src/test/resources/conf/authn/rp-credentials.xml
@@ -1,4 +1,3 @@
-
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:context="http://www.springframework.org/schema/context"
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list