[java-idp-plugin-oidc-rp] branch main updated: More cleanup and package changes
Phil Smart
philip.smart at jisc.ac.uk
Thu Sep 8 15:15:16 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=9be6f4358c584d187ddd2ffcc535eeb612842182
The following commit(s) were added to refs/heads/main by this push:
new 9be6f43 More cleanup and package changes
9be6f43 is described below
commit 9be6f4358c584d187ddd2ffcc535eeb612842182
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Thu Sep 8 16:15:09 2022 +0100
More cleanup and package changes
---
.../DefaultEndUserClaimsLookupStrategy.java | 2 +-
.../navigate}/DefaultIDTokenLookupStrategy.java | 2 +-
.../DefaultUserInfoTokenLookupStrategy.java | 2 +-
...viderMetadataFromOuboundPeerLookupStrategy.java | 19 +++-
.../TokenResponseIDTokenLookupStrategy.java | 2 +-
.../AbstractOIDCAuthenticationRequestAction.java | 9 +-
.../AbstractOIDCAuthenticationResponseAction.java | 16 ++--
.../AddAuthenticationContextClassReferences.java | 2 +-
.../plugin/authn/oidc/rp/impl/AddEndpointURI.java | 3 -
.../authn/oidc/rp/impl/AddResponseTypeAndMode.java | 3 +-
.../oidc/rp/impl/AuthorizationController.java | 5 -
.../authn/oidc/rp/impl/BuildRequestObject.java | 38 +++++---
.../oidc/rp/impl/DefaultClaimMergingStrategy.java | 6 +-
.../rp/impl/DefaultResponseModeLookupFunction.java | 104 ---------------------
.../rp/impl/DefaultResponseTypeLookupFunction.java | 79 ----------------
.../rp/impl/InitializeAuthorizationRequest.java | 4 +-
.../authn/oidc/rp/impl/MockCredentialResolver.java | 35 -------
.../rp/impl/OIDCAuthenticationTimeRequested.java | 33 -------
.../rp/impl/PopulateJWTDecryptionParameters.java | 3 +-
...yingPartyProxyEncryptionParametersResolver.java | 68 --------------
...RelyingPartyProxySigningParametersResolver.java | 1 -
...henticationRequestNonceClaimLookupStrategy.java | 2 +-
.../impl/ManyValuesIntegerComparisonPredicate.java | 2 +-
.../impl/NonceValidationActivationCondition.java | 2 +-
.../META-INF/net.shibboleth.idp/postconfig.xml | 17 ++--
.../oidc-relying-party-authn-beans.xml | 12 +--
.../oidc-relying-party-authn-flow.xml | 1 -
.../idp/service/relying-party/postconfig.xml | 12 +--
.../plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java | 1 -
.../TokenResponseIDTokenLookupStrategyTest.java | 1 +
.../flow/AbstractAuthnXmlFlowExecutionTests.java | 13 ++-
31 files changed, 106 insertions(+), 393 deletions(-)
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/DefaultEndUserClaimsLookupStrategy.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/DefaultEndUserClaimsLookupStrategy.java
similarity index 97%
rename from idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/DefaultEndUserClaimsLookupStrategy.java
rename to idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/DefaultEndUserClaimsLookupStrategy.java
index 0cf9d83..b204019 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/DefaultEndUserClaimsLookupStrategy.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/DefaultEndUserClaimsLookupStrategy.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
+package net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate;
import java.util.function.Function;
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/DefaultIDTokenLookupStrategy.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/DefaultIDTokenLookupStrategy.java
similarity index 97%
rename from idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/DefaultIDTokenLookupStrategy.java
rename to idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/DefaultIDTokenLookupStrategy.java
index 8a8366f..69eb757 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/DefaultIDTokenLookupStrategy.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/DefaultIDTokenLookupStrategy.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
+package net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate;
import java.util.function.Function;
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/DefaultUserInfoTokenLookupStrategy.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/DefaultUserInfoTokenLookupStrategy.java
similarity index 98%
rename from idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/DefaultUserInfoTokenLookupStrategy.java
rename to idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/DefaultUserInfoTokenLookupStrategy.java
index f60abf3..e24614f 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/DefaultUserInfoTokenLookupStrategy.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/DefaultUserInfoTokenLookupStrategy.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
+package net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate;
import java.util.function.Function;
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCProviderMetadataFromOuboundPeerLookupStrategy.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/OIDCProviderMetadataFromOuboundPeerLookupStrategy.java
similarity index 55%
rename from idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCProviderMetadataFromOuboundPeerLookupStrategy.java
rename to idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/OIDCProviderMetadataFromOuboundPeerLookupStrategy.java
index 85c0812..57e74f2 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCProviderMetadataFromOuboundPeerLookupStrategy.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/OIDCProviderMetadataFromOuboundPeerLookupStrategy.java
@@ -1,4 +1,21 @@
-package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate;
import java.util.function.Function;
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/TokenResponseIDTokenLookupStrategy.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/TokenResponseIDTokenLookupStrategy.java
similarity index 97%
rename from idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/TokenResponseIDTokenLookupStrategy.java
rename to idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/TokenResponseIDTokenLookupStrategy.java
index dd4ebbb..cd35f3f 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/TokenResponseIDTokenLookupStrategy.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/TokenResponseIDTokenLookupStrategy.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
+package net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate;
import java.util.function.Function;
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractOIDCAuthenticationRequestAction.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractOIDCAuthenticationRequestAction.java
index 6cd97a8..d3e3e53 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractOIDCAuthenticationRequestAction.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractOIDCAuthenticationRequestAction.java
@@ -111,7 +111,8 @@ public abstract class AbstractOIDCAuthenticationRequestAction extends AbstractAu
/**
- * Returns the authentication request build by this IdP.
+ * Returns the authentication request build by this IdP. Should never be
+ * {@code null} after {@link #doPreExecute(ProfileRequestContext)} has been called.
*
* @return the authentication request.
*/
@@ -120,7 +121,8 @@ public abstract class AbstractOIDCAuthenticationRequestAction extends AbstractAu
}
/**
- * Returns the profile configuration associated with this request.
+ * Returns the profile configuration associated with this request.Should never be
+ * {@code null} after {@link #doPreExecute(ProfileRequestContext)} has been called.
*
* @return the profile configuration
*/
@@ -130,7 +132,8 @@ public abstract class AbstractOIDCAuthenticationRequestAction extends AbstractAu
/**
- * Returns the OpenID Provider metadata.
+ * Returns the OpenID Provider metadata. Should never be {@code null} after
+ * {@link #doPreExecute(ProfileRequestContext)} has been called.
*
* @return The provider metadata context.
*/
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractOIDCAuthenticationResponseAction.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractOIDCAuthenticationResponseAction.java
index 18bcc46..3504c53 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractOIDCAuthenticationResponseAction.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractOIDCAuthenticationResponseAction.java
@@ -43,10 +43,11 @@ import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
/**
+ * Abstract class for actions based on the {@link AuthenticationResponse} located under
+ * the {@link ProfileRequestContext#getInboundMessageContext())} and the built {@link OIDCAuthenticationRequest}
+ * located under the {@link ProfileRequestContext#getOutboundMessageContext()}.
*
- * Abstract class for actions performing actions on {@link AuthenticationResponse} located under
- * the {@link ProfileRequestContext#getOutboundMessageContext())}.
- *
+ * <p>Also makes available the OpenID Provider metadata context</p>
*/
public abstract class AbstractOIDCAuthenticationResponseAction extends AbstractAuthenticationAction {
@@ -88,7 +89,8 @@ public abstract class AbstractOIDCAuthenticationResponseAction extends AbstractA
/**
- * Returns the authentication response from the downstream OP.
+ * Returns the authentication response from the downstream OP. Should never
+ * be {@code null} after {@link #doPreExecute(ProfileRequestContext)} has been called.
*
* @return the authentication response.
*/
@@ -97,7 +99,8 @@ public abstract class AbstractOIDCAuthenticationResponseAction extends AbstractA
}
/**
- * Returns the authentication request build by this IdP.
+ * Returns the authentication request build by this IdP. Should never
+ * be {@code null} after {@link #doPreExecute(ProfileRequestContext)} has been called.
*
* @return the authentication request.
*/
@@ -107,7 +110,8 @@ public abstract class AbstractOIDCAuthenticationResponseAction extends AbstractA
/**
- * Returns the OIDC provider metadata context.
+ * Returns the OIDC provider metadata context. Should never
+ * be {@code null} after {@link #doPreExecute(ProfileRequestContext)} has been called.
*
* @return The provider metadata context.
*/
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddAuthenticationContextClassReferences.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddAuthenticationContextClassReferences.java
index a526704..5b9e7cd 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddAuthenticationContextClassReferences.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddAuthenticationContextClassReferences.java
@@ -35,7 +35,7 @@ import net.shibboleth.oidc.authn.principal.AuthenticationContextClassReferencePr
/**
* An action that adds any authentication context class references from the those derived from the
- * profile config - which may be proxied and mapped from the upstream request.
+ * profile config - which may be proxied and mapped from the original request.
*/
public class AddAuthenticationContextClassReferences extends AbstractOIDCAuthenticationRequestAction {
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddEndpointURI.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddEndpointURI.java
index 1caaa3e..0d058e3 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddEndpointURI.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddEndpointURI.java
@@ -42,7 +42,4 @@ public class AddEndpointURI extends AbstractOIDCAuthenticationRequestAction {
log.trace("{} Added authorization endpoint '{}' to authentication request for client '{}'",getLogPrefix(),
getAuthenticationRequest().getEndpointURI(), getAuthenticationRequest().getClientID());
}
-
-
-
}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddResponseTypeAndMode.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddResponseTypeAndMode.java
index c5e24db..2ebdf04 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddResponseTypeAndMode.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddResponseTypeAndMode.java
@@ -31,13 +31,12 @@ import com.nimbusds.oauth2.sdk.ResponseType;
import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.profile.IdPEventIds;
-import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
/**
* Action that populates the authentication request response_mode and response_type from various stratagies,
* by default from the profile configuration.
*
- * TODO finish
+ * <p>Unless explicitly set, the default response_mode for the specified response_type will be used.</p>
*/
public class AddResponseTypeAndMode extends AbstractOIDCAuthenticationRequestAction {
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthorizationController.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthorizationController.java
index 0fbdb2a..45959db 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthorizationController.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthorizationController.java
@@ -18,8 +18,6 @@
package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
import java.io.IOException;
-import java.net.URI;
-import java.util.function.BiFunction;
import java.util.function.Function;
import javax.annotation.Nonnull;
@@ -44,8 +42,6 @@ import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
-import com.nimbusds.oauth2.sdk.id.State;
-
import net.shibboleth.idp.authn.ExternalAuthentication;
import net.shibboleth.idp.authn.ExternalAuthenticationException;
import net.shibboleth.idp.authn.context.AuthenticationContext;
@@ -55,7 +51,6 @@ import net.shibboleth.idp.plugin.authn.oidc.rp.context.OIDCAuthnContext;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.OIDCPeerEntityContext;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.OutboundMessageHandlerContext;
import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
-import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.component.AbstractInitializableComponent;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/BuildRequestObject.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/BuildRequestObject.java
index 45cf1b7..37ee5f6 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/BuildRequestObject.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/BuildRequestObject.java
@@ -41,11 +41,11 @@ import net.shibboleth.utilities.java.support.component.ComponentSupport;
/**
- * Action that creates a Request Object {@link JWT} object, and sets it to work context
+ * Action that creates a Request Object {@link JWT}, and sets it to work context
* {@link OIDCAuthenticationRequest} located under {@link ProfileRequestContext#getOutboundMessageContext()}.
*
* <p>Note, some parameters are set downstream before the request object is signed and or encrypted. These
- * parameters are only available to the Http Controller e.g. state and hostname, and must be set during the external
+ * parameters are only available to the Http Controller e.g. state, and must be set during the external
* authentication redirect.</p>
*/
public class BuildRequestObject extends AbstractOIDCAuthenticationRequestAction {
@@ -53,7 +53,7 @@ public class BuildRequestObject extends AbstractOIDCAuthenticationRequestAction
/** Class logger. */
@Nonnull private final Logger log = LoggerFactory.getLogger(BuildRequestObject.class);
- /** A hook to allow additional checking of the request object claims after it is build.*/
+ /** A hook to allow additional checking of the request object claims after it is built.*/
@Nonnull private Predicate<ClaimsSet> claimsSetIsValidPredicate;
/**
@@ -125,18 +125,19 @@ public class BuildRequestObject extends AbstractOIDCAuthenticationRequestAction
return;
}
requestObjectClaims.setIssuer(new Issuer(authnRequest.getClientID().getValue()));
- }
+ }
- //TODO lots of possible NPEs here?
- requestObjectClaims.setClaim("client_id", getAuthenticationRequest().getClientID().toString());
- requestObjectClaims.setClaim("nonce", authnRequest.getNonce().getValue());
- requestObjectClaims.setClaim("response_type", authnRequest.getResponseType().toString());
+ requestObjectClaims.setClaim("client_id", getAuthenticationRequest().getClientID().toString());
+
+ setClaimIfPresent(requestObjectClaims, "nonce", authnRequest.getNonce());
+ setClaimIfPresent(requestObjectClaims, "response_type", authnRequest.getResponseType());
// Only set the response_mode if not equal to the default for that response_type
- if (!authnRequest.getDefaultResponseMode().equals(authnRequest.getResponseMode())){
+ if (authnRequest.getDefaultResponseMode() != null &&
+ !authnRequest.getDefaultResponseMode().equals(authnRequest.getResponseMode())){
requestObjectClaims.setClaim("response_mode", authnRequest.getResponseMode());
}
- requestObjectClaims.setClaim("redirect_uri", authnRequest.getRedirectURI().toString());
- requestObjectClaims.setClaim("scope", authnRequest.getScope().toString());
+ setClaimIfPresent(requestObjectClaims, "redirect_uri", authnRequest.getRedirectURI());
+ setClaimIfPresent(requestObjectClaims,"scope", authnRequest.getScope());
if (authnRequest.getRequestedClaims() != null) {
requestObjectClaims.setClaim("claims", authnRequest.getRequestedClaims());
@@ -159,6 +160,21 @@ public class BuildRequestObject extends AbstractOIDCAuthenticationRequestAction
}
+ /**
+ * Set the claim onto the claims set if not {@code null}. Calls toString on each value, assuming it
+ * will produce the correct value.
+ *
+ * @param claims the claims set
+ * @param claimName the claim name
+ * @param claim the claim
+ */
+ private void setClaimIfPresent(
+ @Nonnull final ClaimsSet claims, @Nonnull final String claimName, @Nullable final Object claim) {
+ if (claim != null) {
+ claims.setClaim(claimName, claim.toString());
+ }
+ }
+
/**
* Ensure the request object is valid by assessing the claims are correct.
*
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/DefaultClaimMergingStrategy.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/DefaultClaimMergingStrategy.java
index 70f5797..0c98915 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/DefaultClaimMergingStrategy.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/DefaultClaimMergingStrategy.java
@@ -19,7 +19,6 @@ package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
import java.util.HashMap;
import java.util.Map;
-import java.util.function.BiFunction;
import java.util.function.BinaryOperator;
import javax.annotation.Nonnull;
@@ -28,16 +27,15 @@ import javax.annotation.Nullable;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
-import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
/**
* A default merging strategy for combing claims in the UserInfo response with those from the id_token.
* <ol>
- * <li>If one of userInfo or idToken claims are null, the other is returned.</li>
+ * <li>If one of UserInfo or id_token claims are null, the other is returned.</li>
* <li>If both input claims are null, an empty claimsset is returned.</li>
* <li>Merges the id_token claims into the UserInfo claims, the value of a claim from the id_token
- * is taken over that from the UserInfo response if they claim keys clash.</li>
+ * is taken over that from the UserInfo response if the claim keys clash.</li>
* </ol>
*/
//TODO maybe this should filter claims as well e.g. exp etc. Security check this logic.
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/DefaultResponseModeLookupFunction.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/DefaultResponseModeLookupFunction.java
deleted file mode 100644
index a23711a..0000000
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/DefaultResponseModeLookupFunction.java
+++ /dev/null
@@ -1,104 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
-
-import java.util.function.BiFunction;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import com.nimbusds.oauth2.sdk.ParseException;
-import com.nimbusds.oauth2.sdk.ResponseMode;
-import com.nimbusds.oauth2.sdk.ResponseType;
-
-import net.shibboleth.idp.profile.config.ProfileConfiguration;
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-
-/**
- * A lookup function that returns a response_mode compatible with the response_type described.
- * The response_mode can be overriden by the profile configuration.
- */
- at Deprecated
-public class DefaultResponseModeLookupFunction
- implements BiFunction<ProfileRequestContext, ResponseType, ResponseMode> {
-
- /** Class logger. */
- @Nonnull
- private final Logger log = LoggerFactory.getLogger(DefaultResponseModeLookupFunction.class);
-
- /**
- * Strategy used to locate the {@link RelyingPartyContext} associated with a given {@link ProfileRequestContext}.
- */
- @Nonnull private Function<ProfileRequestContext,RelyingPartyContext> relyingPartyContextLookupStrategy;
-
- /** Constructor. */
- public DefaultResponseModeLookupFunction() {
- relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
- }
-
- /**
- * Set the strategy used to locate the {@link RelyingPartyContext} associated with a given
- * {@link ProfileRequestContext}.
- *
- * @param strategy lookup strategy
- */
- public void setRelyingPartyContextLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,RelyingPartyContext> strategy) {
- relyingPartyContextLookupStrategy =
- Constraint.isNotNull(strategy, "RelyingPartyContext lookup strategy cannot be null");
- }
-
- @Override
- @Nonnull public ResponseMode apply(@Nullable final ProfileRequestContext profileRequestContext,
- @Nonnull final ResponseType responseType) {
-
-// if (profileRequestContext != null) {
-// final RelyingPartyContext rpc = relyingPartyContextLookupStrategy.apply(profileRequestContext);
-// if (rpc != null) {
-// final ProfileConfiguration pc = rpc.getProfileConfig();
-// if (pc instanceof OIDCAuthorizationConfiguration) {
-// final String responseMode =
-// ((OIDCAuthorizationConfiguration) pc).getResponseMode(profileRequestContext);
-// try {
-// final ResponseType responseTypeParsed = ResponseType.parse(responseType);
-// log.debug("Returning response_type '{}' from profile configuration", responseTypeParsed);
-// return responseTypeParsed;
-// } catch (final ParseException e) {
-// log.warn("Configured response_type '{}' is not valid, returning default '{}'",
-// responseType, DEFAULT_RESPONSE_TYPE);
-// return DEFAULT_RESPONSE_TYPE;
-// }
-// }
-// }
-// }
- //TODO extract possible response mode from profile config as well. Must be compatible with the response_type
- final ResponseMode compatibleMode = ResponseMode.resolve(null, responseType);
- log.debug("Response mode '{}' resolved from response type '{}'", compatibleMode, responseType);
- return compatibleMode;
-
- }
-
-}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/DefaultResponseTypeLookupFunction.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/DefaultResponseTypeLookupFunction.java
deleted file mode 100644
index 6c9c0f2..0000000
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/DefaultResponseTypeLookupFunction.java
+++ /dev/null
@@ -1,79 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import com.nimbusds.oauth2.sdk.ParseException;
-import com.nimbusds.oauth2.sdk.ResponseType;
-
-import net.shibboleth.idp.profile.config.ProfileConfiguration;
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
-
-/**
- * A lookup function that returns a response_type from that specified in the profile configuration. If none
- * are configured, or the one configured is invalid, the default 'code' will be returned.
- */
- at Deprecated
-public class DefaultResponseTypeLookupFunction extends AbstractRelyingPartyLookupFunction<ResponseType> {
-
- /** The Default response type if none is selected.*/
- @Nonnull private static final ResponseType DEFAULT_RESPONSE_TYPE = ResponseType.CODE;
-
- /** Class logger. */
- @Nonnull
- private final Logger log = LoggerFactory.getLogger(DefaultResponseTypeLookupFunction.class);
-
- @Override
- @Nonnull public ResponseType apply(@Nullable final ProfileRequestContext profileRequestContext) {
-
- if (profileRequestContext == null) {
- return DEFAULT_RESPONSE_TYPE;
- }
-
- final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(profileRequestContext);
- if (rpc != null) {
- final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof OIDCAuthorizationConfiguration) {
- final String responseType =
- ((OIDCAuthorizationConfiguration) pc).getResponseType(profileRequestContext);
- try {
- final ResponseType responseTypeParsed = ResponseType.parse(responseType);
- log.debug("Returning response_type '{}' from profile configuration", responseTypeParsed);
- return responseTypeParsed;
- } catch (final ParseException e) {
- log.warn("Configured response_type '{}' is not valid, returning default '{}'",
- responseType, DEFAULT_RESPONSE_TYPE);
- return DEFAULT_RESPONSE_TYPE;
- }
- }
- }
-
- log.debug("No response_types configured, "
- + "returning the default '{}' type", DEFAULT_RESPONSE_TYPE);
- return DEFAULT_RESPONSE_TYPE;
- }
-
-}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeAuthorizationRequest.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeAuthorizationRequest.java
index 5799e3d..3585ec6 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeAuthorizationRequest.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeAuthorizationRequest.java
@@ -40,8 +40,8 @@ import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
/**
- * And action that creates an {@link OIDCAuthenticationRequest} shell to build and sets it to the
- * outbound message context.
+ * And action that creates an {@link OIDCAuthenticationRequest} shell to populate in future steps,
+ * and sets it to the outbound message context.
*/
public class InitializeAuthorizationRequest extends AbstractProfileAction {
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/MockCredentialResolver.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/MockCredentialResolver.java
deleted file mode 100644
index 7d9f43c..0000000
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/MockCredentialResolver.java
+++ /dev/null
@@ -1,35 +0,0 @@
-package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
-
-import java.util.List;
-
-import javax.crypto.spec.SecretKeySpec;
-
-import org.opensaml.security.credential.Credential;
-import org.opensaml.security.credential.CredentialResolver;
-
-import com.nimbusds.jose.Algorithm;
-
-import net.shibboleth.oidc.security.credential.BasicJWKCredential;
-import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
-import net.shibboleth.utilities.java.support.resolver.ResolverException;
-
-// TODO tmp class to fit into the trust engine.
-public class MockCredentialResolver implements CredentialResolver {
-
- private static final String ID_TOKEN_HMAC_SECRET = "Xp2s5v8y/B?E(H+MbQeThWmYq3t6w9z$";
-
- @Override
- public Iterable<Credential> resolve(final CriteriaSet criteria) throws ResolverException {
- return List.of(resolveSingle(criteria));
- }
-
- @Override
- public Credential resolveSingle(final CriteriaSet criteria) throws ResolverException {
- final var cred = new BasicJWKCredential();
- cred.setAlgorithm(Algorithm.parse("HS256"));
- cred.setSecretKey(new SecretKeySpec(ID_TOKEN_HMAC_SECRET.getBytes(), "HS256"));
- return cred;
-
- }
-
-}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCAuthenticationTimeRequested.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCAuthenticationTimeRequested.java
deleted file mode 100644
index f29bd12..0000000
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCAuthenticationTimeRequested.java
+++ /dev/null
@@ -1,33 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
-
-import java.util.function.Predicate;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-/** Was the authentication_time requested? */
-//TODO well no if you do not complete this predicate.
-public class OIDCAuthenticationTimeRequested implements Predicate<ProfileRequestContext> {
-
- @Override
- public boolean test(ProfileRequestContext t) {
- return false;
- }
-
-}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/PopulateJWTDecryptionParameters.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/PopulateJWTDecryptionParameters.java
index 72d1446..b238d66 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/PopulateJWTDecryptionParameters.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/PopulateJWTDecryptionParameters.java
@@ -173,8 +173,7 @@ public class PopulateJWTDecryptionParameters extends AbstractProfileAction {
return;
}
- try {
-
+ try {
final JWTDecryptionParameters params =
resolver.resolveSingle(buildCriteriaSet(profileRequestContext, configs));
paramsCtx.setDecryptionParameters(params);
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/RelyingPartyProxyEncryptionParametersResolver.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/RelyingPartyProxyEncryptionParametersResolver.java
deleted file mode 100644
index defc219..0000000
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/RelyingPartyProxyEncryptionParametersResolver.java
+++ /dev/null
@@ -1,68 +0,0 @@
-package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
-
-import java.util.ArrayList;
-import java.util.List;
-import java.util.function.Predicate;
-
-import javax.annotation.Nonnull;
-
-import org.opensaml.security.credential.Credential;
-import org.opensaml.xmlsec.EncryptionParameters;
-import org.opensaml.xmlsec.impl.BasicEncryptionParametersResolver;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import com.nimbusds.jose.JWSAlgorithm;
-
-import net.shibboleth.oidc.security.criterion.StaticCredentialCriterion;
-import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
-
-public class RelyingPartyProxyEncryptionParametersResolver extends BasicEncryptionParametersResolver {
-
- /** Logger. */
- private final Logger log = LoggerFactory.getLogger(RelyingPartyProxyEncryptionParametersResolver.class);
-
- @Override
- protected void resolveAndPopulateCredentialsAndAlgorithms(@Nonnull final EncryptionParameters params,
- @Nonnull final CriteriaSet criteria, @Nonnull final Predicate<String> includeExcludePredicate) {
-
- super.resolveAndPopulateCredentialsAndAlgorithms(params, criteria, includeExcludePredicate);
-// final List<Credential> allCredentials = new ArrayList<>();
-//
-// // Add any static credentials from the criteria
-// if (criteria.contains(StaticCredentialCriterion.class)) {
-// final Credential staticCred = criteria.get(StaticCredentialCriterion.class).getCredential();
-// log.trace("Signing credential found in criterion '{}'", staticCred.getKeyNames());
-// allCredentials.add(staticCred);
-// }
-//
-// // Add any credentials from the configuration
-// allCredentials.addAll(getEffectiveDataEncryptionCredentials(criteria));
-//
-// // Get effective signature algorithms from configuration and include/exclude predicate
-// final List<String> algorithms = getEffectiveSignatureAlgorithms(criteria, includeExcludePredicate);
-//
-// // Filter by those supported by the downstream OP
-// final List<String> filteredAlgorithms = filterForOPSupportedAlgorithms(criteria, algorithms);
-// final List<JWSAlgorithm> supportedAlgorithms = convertSupportAlgorithmsToJwkAlgorithms(filteredAlgorithms);
-// log.trace("Resolved effective signature algorithms: {}", supportedAlgorithms);
-//
-// // Pick the first credential that matches one of the supported algorithms
-// for (final Credential credential : allCredentials) {
-// log.trace("Evaluating signing credential '{}'", credential.getKeyNames());
-// final JWSAlgorithm foundSupportedAlgorithm =
-// credentialSupportsSigningAlgorithm(credential, supportedAlgorithms);
-// if (foundSupportedAlgorithm != null) {
-// log.trace("Credential supports algorithm '{}'", foundSupportedAlgorithm);
-// params.setSigningCredential(credential);
-// params.setSignatureAlgorithm(foundSupportedAlgorithm.getName());
-// return;
-// }
-// log.trace("Credential failed eval against Signing Algorithm");
-//
-// }
- }
-
-
-
-}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/RelyingPartyProxySigningParametersResolver.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/RelyingPartyProxySigningParametersResolver.java
index 6069267..a43fd15 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/RelyingPartyProxySigningParametersResolver.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/RelyingPartyProxySigningParametersResolver.java
@@ -29,7 +29,6 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.security.credential.Credential;
-import org.opensaml.xmlsec.SignatureSigningParameters;
import org.opensaml.xmlsec.impl.BasicSignatureSigningParametersResolver;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthenticationRequestNonceClaimLookupStrategy.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/security/impl/AuthenticationRequestNonceClaimLookupStrategy.java
similarity index 97%
rename from idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthenticationRequestNonceClaimLookupStrategy.java
rename to idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/security/impl/AuthenticationRequestNonceClaimLookupStrategy.java
index c8f3b2b..183b977 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthenticationRequestNonceClaimLookupStrategy.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/security/impl/AuthenticationRequestNonceClaimLookupStrategy.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
+package net.shibboleth.idp.plugin.authn.oidc.rp.security.impl;
import java.util.function.BiFunction;
import java.util.function.Function;
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ManyValuesIntegerComparisonPredicate.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/security/impl/ManyValuesIntegerComparisonPredicate.java
similarity index 94%
rename from idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ManyValuesIntegerComparisonPredicate.java
rename to idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/security/impl/ManyValuesIntegerComparisonPredicate.java
index eff2379..e3df5b2 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ManyValuesIntegerComparisonPredicate.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/security/impl/ManyValuesIntegerComparisonPredicate.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
+package net.shibboleth.idp.plugin.authn.oidc.rp.security.impl;
import java.util.function.IntPredicate;
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/NonceValidationActivationCondition.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/security/impl/NonceValidationActivationCondition.java
similarity index 98%
rename from idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/NonceValidationActivationCondition.java
rename to idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/security/impl/NonceValidationActivationCondition.java
index 5329631..7b361db 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/NonceValidationActivationCondition.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/security/impl/NonceValidationActivationCondition.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
+package net.shibboleth.idp.plugin.authn.oidc.rp.security.impl;
import java.util.function.BiPredicate;
import java.util.function.Function;
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index e021f89..70a7ad2 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -132,7 +132,7 @@
<!-- lookup strategies required by the postconfig in addition to the flow -->
<bean id="shibboleth.authn.oidc.rp.DefaultIDTokenLookupStrategy"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.DefaultIDTokenLookupStrategy" />
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.DefaultIDTokenLookupStrategy" />
<!-- The authentication flow descriptor -->
@@ -194,12 +194,9 @@
class="net.shibboleth.oidc.profile.spring.relyingparty.metadata.impl.ProviderMetadataResolverServiceStrategy" />
</constructor-arg>
</bean>
-
- <!-- TODO ADD BACK THE CONDITION (GET TO WORK WITH TEST) <util:list id="shibboleth.DefaultProviderMetadataResolverResources">
- <value>conditional:%{idp.home}/conf/oidc-providermetadata-resolvers.xml</value> OR <value>classpath:/conf/oidc-providermetadata-resolvers.xml</value>
- </util:list> -->
+
<util:list id="shibboleth.DefaultProviderMetadataResolverResources">
- <value>%{idp.home}/conf/authn/oidc-providermetadata-resolvers.xml</value> <!-- should be a conditional:? -->
+ <value>conditional:%{idp.home}/conf/authn/oidc-providermetadata-resolvers.xml</value> <!-- should be a conditional:? -->
</util:list>
<!-- Auto-append system config file to resource set. -->
<bean id="ExtendedProviderMetadataResolverResources"
@@ -214,8 +211,10 @@
</property>
</bean>
- <!-- JWK Cache service for provider keys used inside the trust engine. Will use the same storage engine and context and
- the OP?! The key is the URI, so that should be fine. -->
+ <!--
+ JWK Cache service for provider keys. Will use the same storage engine and context and
+ the OP. The key is the URI, so that should be fine.
+ -->
<bean id="shibboleth.authn.oidc.rp.RemoteJwkSetCache" class="net.shibboleth.oidc.jwk.RemoteJwkSetCache"
p:storage-ref="#{'%{idp.oidc.rp.jwk.StorageService:shibboleth.StorageService}'.trim()}"
p:httpClient="#{getObject('shibboleth.oidc.rp.NonBrowser.HttpClient') ?: getObject('shibboleth.InternalHttpClient')}"
@@ -406,7 +405,7 @@
</bean>
<bean id="shibboleth.authn.oidc.rp.DefaultEndUserClaimsLookupStrategy"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.DefaultEndUserClaimsLookupStrategy"
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.DefaultEndUserClaimsLookupStrategy"
c:endUserClaimsContextLookupStrategy="#{getObject('shibboleth.authn.oidc.rp.EndUserClaimsContextLookupStrategy')}"/>
<bean id="shibboleth.oidc.rp.DefaultTokenResponseAuditExtractors" lazy-init="true"
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
index a0f7060..7dd952b 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
@@ -390,7 +390,7 @@
p:rawIdTokenLookupStrategy-ref="TokenResponseIDTokenLookupStrategy" />
<bean id="TokenResponseIDTokenLookupStrategy"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.TokenResponseIDTokenLookupStrategy" />
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.TokenResponseIDTokenLookupStrategy" />
<!-- could these be singletons? -->
<bean id="shibboleth.authn.oidc.rp.DefaultTokenResponseDecoder" scope="prototype"
@@ -601,7 +601,7 @@
<!-- TODO, seems like this could be done in XML somehow -->
<bean id="ManyValuesPredicate"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.ManyValuesIntegerComparisonPredicate" />
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.security.impl.ManyValuesIntegerComparisonPredicate" />
<bean id="AzpClaimsValidator" class="net.shibboleth.oidc.security.jwt.claims.impl.ExactMatchClaimsValidator"
p:claimName="azp" p:valueToMatchLookupStrategy-ref="ClientIDFromOAuth2ClientContextFunction">
@@ -617,7 +617,7 @@
<!-- TODO This bean could be replaced by XML functions? Could also be from the inbound message context at this point -->
<bean id="OIDCProviderMetadataContextFromOutboundPeerLookupStrategy"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.OIDCProviderMetadataFromOuboundPeerLookupStrategy" />
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.OIDCProviderMetadataFromOuboundPeerLookupStrategy" />
<bean id="AudienceClaimsValidator" class="net.shibboleth.oidc.security.jwt.claims.impl.AudienceClaimsValidator"
p:audienceLookupStrategy-ref="ClientIDFromOAuth2ClientContextFunction" />
@@ -637,10 +637,10 @@
getObject('shibboleth.authn.oidc.rp.jwt.DefaultNonceActivationCondition')}" />
<bean id="shibboleth.authn.oidc.rp.jwt.DefaultNonceActivationCondition"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.NonceValidationActivationCondition" />
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.security.impl.NonceValidationActivationCondition" />
<bean id="shibboleth.authn.oidc.rp.jwt.DefaultNonceLookupStrategy"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.AuthenticationRequestNonceClaimLookupStrategy" />
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.security.impl.AuthenticationRequestNonceClaimLookupStrategy" />
<bean id="OIDCMetadataContextChildLookup" class="org.opensaml.messaging.context.navigate.ChildContextLookup"
@@ -770,7 +770,7 @@
</bean>
<bean id="shibboleth.authn.oidc.rp.DefaultUserInfoTokenLookupStrategy"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.DefaultUserInfoTokenLookupStrategy" />
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.DefaultUserInfoTokenLookupStrategy" />
<bean id="ValidateUserInfoTokenClaims" scope="prototype"
class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.ValidateTokenClaims"
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-flow.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-flow.xml
index e5a7ef3..f273a51 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-flow.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-flow.xml
@@ -218,7 +218,6 @@
<!-- Route everything out as a graceful failure to allow subsequent options to run. -->
<transition on="#{!'proceed'.equals(currentEvent.id)}" to="ReselectFlow">
<evaluate expression="T(org.opensaml.core.metrics.MetricsSupport).getMetricRegistry().counter('net.shibboleth.idp.authn.oidc.rp.failures').inc()" />
- <evaluate expression="WriteAuditLog" />
</transition>
</global-transitions>
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index 936df83..fc03ca7 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -104,10 +104,7 @@
p:KEKCredentialResolver-ref="defaultOIDCRPKeyEncryptionCredentialResolver"
p:contentEncryptionKeyCredentialResolver-ref="defaultOIDCRPContentEncryptionKeyCredentialResolver">
<property name="keyTransportEncryptionAlgorithms">
- <list>
- <!-- TODO move this KW back to original order -->
- <!-- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_DIR" /> -->
+ <list>
<util:constant
static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_RSA_1_5" />
<util:constant
@@ -144,7 +141,7 @@
<util:constant
static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A192CBC_HS384" />
<util:constant
- static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A256CBC_HS512" />
+ static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A256CBC_HS512" />
</list>
</property>
</bean>
@@ -232,7 +229,8 @@
<!--
A resolver to resolve pre-shared Direct Encryption or Key Wrapping credentials based on the
- client_secret in the input criterion
+ client_secret in the input criterion. Returns the raw value, even though the key to use
+ is a derivative of this key
-->
<bean id="defaultOIDCRPContentEncryptionKeyCredentialResolver"
class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
@@ -273,6 +271,4 @@
c:JOSEObjectResolver-ref="defaultSignedJWTJOSEHeaderCredentialResolver" />
-
-
</beans>
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java
index 0fa1ed2..2d12e67 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java
@@ -34,7 +34,6 @@ import org.apache.http.conn.ssl.TrustAllStrategy;
import org.apache.http.impl.client.HttpClients;
import org.apache.http.ssl.SSLContextBuilder;
import org.junit.Test;
-import org.mockito.Mockito;
import org.opensaml.core.config.InitializationException;
import org.opensaml.core.metrics.impl.MetricRegistryInitializer;
import org.opensaml.messaging.context.MessageContext;
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/TokenResponseIDTokenLookupStrategyTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/TokenResponseIDTokenLookupStrategyTest.java
index 299d5b6..02ada5f 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/TokenResponseIDTokenLookupStrategyTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/TokenResponseIDTokenLookupStrategyTest.java
@@ -13,6 +13,7 @@ import org.testng.annotations.Test;
import com.fasterxml.jackson.core.type.TypeReference;
import com.fasterxml.jackson.databind.ObjectMapper;
+import net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.TokenResponseIDTokenLookupStrategy;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.AccessTokenResponseContext;
/** Tests for TokenResponseIDTokenLookupStrategy.*/
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/test/flow/AbstractAuthnXmlFlowExecutionTests.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/test/flow/AbstractAuthnXmlFlowExecutionTests.java
index 76055dc..2f5d05c 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/test/flow/AbstractAuthnXmlFlowExecutionTests.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/test/flow/AbstractAuthnXmlFlowExecutionTests.java
@@ -41,11 +41,13 @@ import org.springframework.beans.factory.xml.XmlBeanDefinitionReader;
import org.springframework.context.ApplicationContext;
import org.springframework.context.ConfigurableApplicationContext;
import org.springframework.context.support.ConversionServiceFactoryBean;
+import org.springframework.context.support.GenericApplicationContext;
import org.springframework.context.support.PropertySourcesPlaceholderConfigurer;
import org.springframework.context.support.StaticApplicationContext;
import org.springframework.core.convert.converter.Converter;
import org.springframework.core.env.Environment;
import org.springframework.core.env.StandardEnvironment;
+import org.springframework.core.io.DefaultResourceLoader;
import org.springframework.core.io.Resource;
import org.springframework.core.io.support.EncodedResource;
import org.springframework.mock.env.MockPropertySource;
@@ -68,12 +70,14 @@ import net.shibboleth.ext.spring.config.PredicateToPredicateConverter;
import net.shibboleth.ext.spring.config.StringBooleanToPredicateConverter;
import net.shibboleth.ext.spring.config.StringToIPRangeConverter;
import net.shibboleth.ext.spring.config.StringToResourceConverter;
+import net.shibboleth.ext.spring.resource.ConditionalResourceResolver;
import net.shibboleth.ext.spring.util.AnnotationParameterNameDiscoverer;
import net.shibboleth.idp.authn.AuthenticationFlowDescriptor;
import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
import net.shibboleth.idp.plugin.authn.test.spring.CustomAbstractXmlFlowExecutionTests;
import net.shibboleth.idp.plugin.authn.test.spring.CustomFlowModelFlowBuilder;
+import net.shibboleth.idp.plugin.authn.test.spring.CustomFlowRelativeResourceLoader;
import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
import net.shibboleth.idp.session.IdPSession;
import net.shibboleth.idp.session.context.SessionContext;
@@ -450,7 +454,8 @@ public abstract class AbstractAuthnXmlFlowExecutionTests extends CustomAbstractX
assertNotNull(factory);
assertTrue(factory instanceof DefaultListableBeanFactory);
- final XmlBeanDefinitionReader beanDefinitionReader = new XmlBeanDefinitionReader((DefaultListableBeanFactory) factory);
+ final XmlBeanDefinitionReader beanDefinitionReader =
+ new XmlBeanDefinitionReader((DefaultListableBeanFactory) factory);
//we need to register the IdentifiableBeanPostProcessor as that is not registered by this point if
//used in the webflow, and this resource is not loading one.
((DefaultListableBeanFactory)factory).addBeanPostProcessor(new IdentifiableBeanPostProcessor());
@@ -465,6 +470,12 @@ public abstract class AbstractAuthnXmlFlowExecutionTests extends CustomAbstractX
((DefaultListableBeanFactory)factory).setConversionService(conversationService.getObject());
+ // Add a resource loader to support 'conditional:' resources in things loaded before the webflow config.
+ // TODO this could break things? although does not seem to.
+ final DefaultResourceLoader loader = new DefaultResourceLoader();
+ loader.addProtocolResolver(new ConditionalResourceResolver());
+ ((GenericApplicationContext)builderContext.getApplicationContext()).setResourceLoader(loader);
+
final int beanNumbers = beanDefinitionReader.loadBeanDefinitions(new EncodedResource(xmlFile, "UTF-8"));
//process any properties in the file bean expressions
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list