[java-idp-plugin-oidc-rp] branch main updated: Bean cleanups, audit logging improvements
Phil Smart
philip.smart at jisc.ac.uk
Fri Sep 9 16:02:46 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=5bd0e94b963c0c0bfed14cbef884168c5d875ce9
The following commit(s) were added to refs/heads/main by this push:
new 5bd0e94 Bean cleanups, audit logging improvements
5bd0e94 is described below
commit 5bd0e94b963c0c0bfed14cbef884168c5d875ce9
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Sep 9 17:02:40 2022 +0100
Bean cleanups, audit logging improvements
---
idp-oidc-rp-impl/pom.xml | 12 ++--
.../rp/audit/impl/FixedStringAuditExtractor.java | 49 ++++++++++++++
.../audit/impl/TransitionActionWriteAuditLog.java | 41 ++++++++++++
.../oidc/rp/impl/AuthorizationController.java | 24 ++-----
.../authn/oidc/rp/impl/ValidateTokenClaims.java | 3 +-
.../META-INF/net.shibboleth.idp/postconfig.xml | 78 ++++++++++++++++++----
.../oidc-relying-party-authn-beans.xml | 67 ++++++++++++++-----
.../oidc-relying-party-authn-flow.xml | 20 +++---
.../rp/conf/authn/clientinfo-resolver-system.xml | 32 ---------
.../conf/authn/oidc-providermetadata-resolvers.xml | 34 ++++++++++
...{rp-credentials.xml => oidc-rp-credentials.xml} | 0
.../authn/providermetadata-resolver-system.xml | 57 ++++++++--------
.../idp/plugin/authn/oidc/rp/module.properties | 16 ++---
.../idp/plugin/authn/oidc/rp/plugin.properties | 2 +-
.../plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java | 2 +-
idp-oidc-rp-impl/src/test/resources/conf/audit.xml | 2 +-
.../conf/authn/oidc-providermetadata-resolvers.xml | 6 +-
...{rp-credentials.xml => oidc-rp-credentials.xml} | 0
18 files changed, 309 insertions(+), 136 deletions(-)
diff --git a/idp-oidc-rp-impl/pom.xml b/idp-oidc-rp-impl/pom.xml
index d9b1433..2a000be 100644
--- a/idp-oidc-rp-impl/pom.xml
+++ b/idp-oidc-rp-impl/pom.xml
@@ -106,6 +106,11 @@
<artifactId>idp-admin-api</artifactId>
<scope>provided</scope>
</dependency>
+ <dependency>
+ <groupId>${idp.groupId}</groupId>
+ <artifactId>idp-profile-impl</artifactId>
+ <scope>provided</scope>
+ </dependency>
<dependency>
<groupId>${idp.groupId}</groupId>
<artifactId>idp-admin-impl</artifactId>
@@ -141,12 +146,7 @@
<groupId>${opensaml.groupId}</groupId>
<artifactId>opensaml-messaging-impl</artifactId>
<scope>test</scope>
- </dependency>
- <dependency>
- <groupId>${idp.groupId}</groupId>
- <artifactId>idp-profile-impl</artifactId>
- <scope>test</scope>
- </dependency>
+ </dependency>
<dependency>
<groupId>${idp.groupId}</groupId>
<artifactId>idp-profile-spring</artifactId>
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/audit/impl/FixedStringAuditExtractor.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/audit/impl/FixedStringAuditExtractor.java
new file mode 100644
index 0000000..4c75062
--- /dev/null
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/audit/impl/FixedStringAuditExtractor.java
@@ -0,0 +1,49 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.authn.oidc.rp.audit.impl;
+
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.utilities.java.support.annotation.ParameterName;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+
+/** A simple audit extractor that allows a fixed string to be logged.*/
+public class FixedStringAuditExtractor implements Function<ProfileRequestContext, String> {
+
+ /** The fixed string to log.*/
+ @Nonnull private final String value;
+
+ /**
+ * Constructor.
+ *
+ * @param stringToLog the fixed string to log
+ */
+ public FixedStringAuditExtractor(@Nonnull @NotEmpty @ParameterName(name = "value") final String stringToLog) {
+ value = Constraint.isNotEmpty(stringToLog, "The fixed string to log can not be empty");
+ }
+
+ @Override
+ public String apply(final ProfileRequestContext input) {
+ return value;
+ }
+}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/audit/impl/TransitionActionWriteAuditLog.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/audit/impl/TransitionActionWriteAuditLog.java
new file mode 100644
index 0000000..4b3bb58
--- /dev/null
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/audit/impl/TransitionActionWriteAuditLog.java
@@ -0,0 +1,41 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.authn.oidc.rp.audit.impl;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.profile.action.ActionSupport;
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.idp.profile.audit.impl.WriteAuditLog;
+
+/**
+ * A simple extension of the {@link WriteAuditLog} action that creates an Event with the string
+ * literal '{@literal success}', such that the write audit log action can be used inside a transition
+ * and does not prevent the transition from proceeding.
+ */
+//TODO WriteAuditLog is profile-impl not API.
+public class TransitionActionWriteAuditLog extends WriteAuditLog {
+
+ @Override
+ protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+ super.doExecute(profileRequestContext);
+ ActionSupport.buildEvent(profileRequestContext, "success");
+ }
+
+}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthorizationController.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthorizationController.java
index 45959db..0f7eb55 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthorizationController.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthorizationController.java
@@ -25,7 +25,6 @@ import javax.annotation.concurrent.ThreadSafe;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
-import javax.servlet.http.HttpSession;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
@@ -58,25 +57,12 @@ import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
/**
- *
* Servlet compatible with the {@link ExternalAuthentication} interface that begins, by HTTP redirect, an
- * OpenID Connect authentication request via OAuth 2.0 Authorization Code Flow to an OpenID Connect
- * Identity Provider (an OAuth 2.0 Authorization Server that supports OpenID Connect).
- * Although other flows could be configured, they shouldn't.
- *
- * <p>As this is part of an OpenID Connect authentication request, the <code>openid</code> scope is required,
- * and as such is automatically set by the {@link SetOIDCInformation} action.</p>
- *
- * <p>Adds the {@link OpenIDConnectContext} to the {@link HttpSession} for extraction after the OAuth 2.0
- * authorisation code response has been consumed, and control as returned to the IdP.</p>
+ * OpenID Connect authentication request to an OpenID Connect Provider (an OAuth 2.0 Authorization Server
+ * that supports OpenID Connect).
*
- * <p>Servlet also consumes the HTTP Request from
- * an OpenID Connect provider (OAuth 2.0 authorization endpoint), which was issued in response to the Authorization
- * Code request. </p>
- * <p>
- * The {@link HttpServletRequest} is placed inside the {@link OpenIDConnectContext} for interrogation later in the flow.
- * </p>
- * FIXME: this description
+ * <p>The servlet also consumes the HTTP authentication response from the OpenID Connect provider, decodes it,
+ * adds it the the input message context, and resumes IdP processing.</p>
*/
@ThreadSafe
@Controller
@@ -239,7 +225,7 @@ public class AuthorizationController extends AbstractInitializableComponent {
}
/**
- * Callback endpoint to accept the authorization request response.
+ * Callback endpoint to accept the authorization response.
*
* @param httpRequest the servlet request.
* @param httpResponse the servlet response.
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateTokenClaims.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateTokenClaims.java
index 9747f38..af4a64b 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateTokenClaims.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateTokenClaims.java
@@ -37,6 +37,7 @@ import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.plugin.authn.oidc.rp.OIDCRPException;
import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
import net.shibboleth.oidc.jwt.claims.JWTValidationException;
+import net.shibboleth.oidc.profile.core.OidcEventIds;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
@@ -183,7 +184,7 @@ public class ValidateTokenClaims extends AbstractOIDCAuthenticationResponseActio
}
} catch (final JWTValidationException e) {
log.error("{} JWT verification failed for subject '{}'", getLogPrefix(),claimsSet.getSubject(),e);
- ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.NO_CREDENTIALS);
+ ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_TOKEN);
if (cleanupHook != null) {
cleanupHook.accept(profileRequestContext);
}
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 70a7ad2..18af883 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -173,15 +173,15 @@
<bean id="shibboleth.authn.OIDC.externalAuthnPath" class="java.lang.String"
c:_0="servletRelative:#{getObject('shibboleth.authn.OIDC.externalServletPath')}#{T(net.shibboleth.idp.plugin.authn.oidc.rp.impl.AuthorizationController).AUTHORIZE_PATH_SEGMENT}" />
- <bean id="shibboleth.oidc.rp.AuthorizationController"
+ <bean id="shibboleth.authn.oidc.rp.AuthorizationController"
class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.AuthorizationController" />
<!-- OpenID Provider information resolver service beans. -->
- <bean id="shibboleth.oidc.rp.ProviderMetadataResolver"
+ <bean id="shibboleth.authn.oidc.rp.ProviderMetadataResolver"
class="net.shibboleth.oidc.metadata.impl.ReloadingProviderMetadataProvider"
- c:resolverService-ref="shibboleth.oidc.rp.ProviderMetadataResolverService" />
+ c:resolverService-ref="shibboleth.authn.oidc.rp.ProviderMetadataResolverService" />
- <bean id="shibboleth.oidc.rp.ProviderMetadataResolverService"
+ <bean id="shibboleth.authn.oidc.rp.ProviderMetadataResolverService"
class="net.shibboleth.ext.spring.service.ReloadableSpringService"
p:serviceConfigurations-ref="ExtendedProviderMetadataResolverResources"
p:failFast="%{idp.service.providermetadata.failFast:%{idp.service.failFast:false}}"
@@ -196,7 +196,7 @@
</bean>
<util:list id="shibboleth.DefaultProviderMetadataResolverResources">
- <value>conditional:%{idp.home}/conf/authn/oidc-providermetadata-resolvers.xml</value> <!-- should be a conditional:? -->
+ <value>conditional:%{idp.home}/conf/authn/oidc-providermetadata-resolvers.xml</value>
</util:list>
<!-- Auto-append system config file to resource set. -->
<bean id="ExtendedProviderMetadataResolverResources"
@@ -217,15 +217,15 @@
-->
<bean id="shibboleth.authn.oidc.rp.RemoteJwkSetCache" class="net.shibboleth.oidc.jwk.RemoteJwkSetCache"
p:storage-ref="#{'%{idp.oidc.rp.jwk.StorageService:shibboleth.StorageService}'.trim()}"
- p:httpClient="#{getObject('shibboleth.oidc.rp.NonBrowser.HttpClient') ?: getObject('shibboleth.InternalHttpClient')}"
- p:httpClientSecurityParameters="#{getObject('shibboleth.oidc.rp.NonBrowser.HttpClientSecurityParameters')}" />
+ p:httpClient="#{getObject('shibboleth.authn.oidc.rp.NonBrowser.HttpClient') ?: getObject('shibboleth.InternalHttpClient')}"
+ p:httpClientSecurityParameters="#{getObject('shibboleth.authn.oidc.rp.NonBrowser.HttpClientSecurityParameters')}" />
<!--
Some RP audit extractors
-->
- <bean id="shibboleth.oidc.rp.DefaultPostLookupAuditExtractors" lazy-init="true"
+ <bean id="shibboleth.authn.oidc.rp.DefaultPostLookupAuditExtractors" lazy-init="true"
class="org.springframework.beans.factory.config.MapFactoryBean">
<property name="sourceMap">
<map>
@@ -252,10 +252,17 @@
</property>
</bean>
- <bean id="shibboleth.oidc.rp.DefaultPostRequestAuditExtractors" lazy-init="true"
+ <bean id="shibboleth.authn.oidc.rp.DefaultPostRequestAuditExtractors" lazy-init="true"
class="org.springframework.beans.factory.config.MapFactoryBean">
<property name="sourceMap">
<map>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.oidc.profile.audit.AuditFields.AUTHENTICATION_FLOW_STEP"/>
+ </key>
+ <bean class="net.shibboleth.idp.plugin.authn.oidc.rp.audit.impl.FixedStringAuditExtractor"
+ c:value="AuthenticationRequest"/>
+ </entry>
<entry>
<key>
<util:constant static-field="net.shibboleth.oidc.profile.audit.AuditFields.RESPONSE_TYPE"/>
@@ -372,10 +379,17 @@
</property>
</bean>
- <bean id="shibboleth.oidc.rp.DefaultAuthenticationResponseAuditExtractors" lazy-init="true"
+ <bean id="shibboleth.authn.oidc.rp.DefaultAuthenticationResponseAuditExtractors" lazy-init="true"
class="org.springframework.beans.factory.config.MapFactoryBean">
<property name="sourceMap">
<map>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.oidc.profile.audit.AuditFields.AUTHENTICATION_FLOW_STEP"/>
+ </key>
+ <bean class="net.shibboleth.idp.plugin.authn.oidc.rp.audit.impl.FixedStringAuditExtractor"
+ c:value="AuthenticationResponse"/>
+ </entry>
<entry>
<key>
<util:constant
@@ -408,10 +422,17 @@
class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.DefaultEndUserClaimsLookupStrategy"
c:endUserClaimsContextLookupStrategy="#{getObject('shibboleth.authn.oidc.rp.EndUserClaimsContextLookupStrategy')}"/>
- <bean id="shibboleth.oidc.rp.DefaultTokenResponseAuditExtractors" lazy-init="true"
+ <bean id="shibboleth.authn.oidc.rp.DefaultTokenResponseAuditExtractors" lazy-init="true"
class="org.springframework.beans.factory.config.MapFactoryBean">
<property name="sourceMap">
<map>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.oidc.profile.audit.AuditFields.AUTHENTICATION_FLOW_STEP"/>
+ </key>
+ <bean class="net.shibboleth.idp.plugin.authn.oidc.rp.audit.impl.FixedStringAuditExtractor"
+ c:value="TokenResponse"/>
+ </entry>
<entry>
<key>
<util:constant
@@ -443,8 +464,41 @@
</property>
</bean>
+
+ <bean id="shibboleth.authn.oidc.rp.DefaultPostJWTUserInfoResponseAuditExtractors" lazy-init="true"
+ class="org.springframework.beans.factory.config.MapFactoryBean">
+ <property name="sourceMap">
+ <map>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.oidc.profile.audit.AuditFields.AUTHENTICATION_FLOW_STEP"/>
+ </key>
+ <bean class="net.shibboleth.idp.plugin.authn.oidc.rp.audit.impl.FixedStringAuditExtractor"
+ c:value="UserInfoJWTResponse"/>
+ </entry>
+ </map>
+ </property>
+ </bean>
+
+ <bean id="shibboleth.authn.oidc.rp.PostPlainUserInfoResponseAuditExtractors" lazy-init="true"
+ class="org.springframework.beans.factory.config.MapFactoryBean">
+ <property name="sourceMap">
+ <map>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.oidc.profile.audit.AuditFields.AUTHENTICATION_FLOW_STEP"/>
+ </key>
+ <bean class="net.shibboleth.idp.plugin.authn.oidc.rp.audit.impl.FixedStringAuditExtractor"
+ c:value="UserInfoPlainResponse"/>
+ </entry>
+ </map>
+ </property>
+ </bean>
+
+
+
<!-- Extract audit information post id_token and (if configured) userinfo response. Nothing by default. -->
- <bean id="shibboleth.oidc.rp.DefaultPostResponseAuditExtractors" lazy-init="true"
+ <bean id="shibboleth.authn.oidc.rp.DefaultPostResponseAuditExtractors" lazy-init="true"
class="org.springframework.beans.factory.config.MapFactoryBean">
<property name="sourceMap">
<map>
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
index 7dd952b..746efe1 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
@@ -65,14 +65,14 @@
<bean class="net.shibboleth.idp.plugin.authn.oidc.rp.metadata.impl.OIDCProviderMetadataLookupHandler"
scope="prototype">
<property name="providerMetadataResolver">
- <ref bean="shibboleth.oidc.rp.ProviderMetadataResolver" />
+ <ref bean="shibboleth.authn.oidc.rp.ProviderMetadataResolver" />
</property>
</bean>
</constructor-arg>
</bean>
- <bean id="shibboleth.oidc.rp.IssuerIDLookupStrategy"
+ <bean id="shibboleth.authn.oidc.rp.IssuerIDLookupStrategy"
class="net.shibboleth.idp.plugin.authn.oidc.rp.metadata.impl.DefaultIssuerIDLookupFunction" scope="prototype" />
<bean id="InitializeRelyingPartyContext"
@@ -97,10 +97,9 @@
<bean id="SelectProfileConfiguration" class="net.shibboleth.idp.profile.impl.SelectProfileConfiguration"
scope="prototype" p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext" />
- <!-- TODO check shibboleth.oidc.rp is sensible in the getObjects -->
<bean id="PostLookupPopulateAuditContext" parent="shibboleth.AbstractPopulateAuditContext"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
- p:fieldExtractors="#{getObject('shibboleth.oidc.rp.PostLookupAuditExtractors') ?: getObject('shibboleth.oidc.rp.DefaultPostLookupAuditExtractors')}" />
+ p:fieldExtractors="#{getObject('shibboleth.authn.oidc.rp.PostLookupAuditExtractors') ?: getObject('shibboleth.authn.oidc.rp.DefaultPostLookupAuditExtractors')}" />
<bean id="InitializeAuthorizationRequest"
@@ -129,7 +128,7 @@
class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.AddRequestedClaims"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
p:authenticationContextLookupStrategy-ref="ParentAuthenticiationContextLookup"
- p:requestedClaimsHook="#{getObject('shibboleth.oidc.rp.RequestedClaimsHook')}" />
+ p:requestedClaimsHook="#{getObject('shibboleth.authn.oidc.rp.RequestedClaimsHook')}" />
<bean id="AddRedirectURI" scope="prototype"
@@ -137,7 +136,7 @@
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
p:authenticationContextLookupStrategy-ref="ParentAuthenticiationContextLookup"
p:httpServletRequest-ref="shibboleth.HttpServletRequest"
- p:redirectUriCreationStrategy="#{getObject('shibboleth.oidc.rp.RedirectUriCreationStrategy') ?: getObject('shibboleth.oidc.rp.DefaultRedirectUriCreationStrategy')}" />
+ p:redirectUriCreationStrategy="#{getObject('shibboleth.authn.oidc.rp.RedirectUriCreationStrategy') ?: getObject('shibboleth.authn.oidc.rp.DefaultRedirectUriCreationStrategy')}" />
<bean id="AddAuthenticationContextClassReferences" scope="prototype"
class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.AddAuthenticationContextClassReferences"
@@ -151,7 +150,7 @@
<bean id="PostRequestPopulateAuditContext" parent="shibboleth.AbstractPopulateAuditContext"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
- p:fieldExtractors="#{getObject('shibboleth.oidc.rp.PostRequestAuditExtractors') ?: getObject('shibboleth.oidc.rp.DefaultPostRequestAuditExtractors')}" />
+ p:fieldExtractors="#{getObject('shibboleth.authn.oidc.rp.PostRequestAuditExtractors') ?: getObject('shibboleth.authn.oidc.rp.DefaultPostRequestAuditExtractors')}" />
<bean id="WriteAuditLog" class="net.shibboleth.idp.profile.audit.impl.WriteAuditLog" scope="prototype"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
@@ -159,7 +158,8 @@
p:dateTimeFormat="#{getObject('shibboleth.AuditDateTimeFormat')}"
p:useDefaultTimeZone="#{getObject('shibboleth.AuditDefaultTimeZone') ?: false}"
p:httpServletRequest-ref="shibboleth.HttpServletRequest" />
-
+
+
<!-- Build RequestObject if required -->
<bean id="RequestObjectRequiredAndSupportedPredicate"
class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic.RequestObjectRequiredAndSupported" />
@@ -300,7 +300,7 @@
</property>
</bean>
- <bean id="shibboleth.oidc.rp.DefaultRedirectUriCreationStrategy"
+ <bean id="shibboleth.authn.oidc.rp.DefaultRedirectUriCreationStrategy"
c:callbackPath="#{getObject('shibboleth.authn.OIDC.externalServletPath')}/callback"
c:allowedOrigins="%{idp.authn.oidc.rp.client.redirecturl.allowedOrigins:}"
class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.DefaultRedirectUriCreationFunction" />
@@ -356,7 +356,7 @@
<bean id="AuthenticationResponsePopulateAuditContext" parent="shibboleth.AbstractPopulateAuditContext"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
- p:fieldExtractors="#{getObject('shibboleth.oidc.rp.AuthenticationResponseAuditExtractors') ?: getObject('shibboleth.oidc.rp.DefaultAuthenticationResponseAuditExtractors')}" />
+ p:fieldExtractors="#{getObject('shibboleth.authn.oidc.rp.AuthenticationResponseAuditExtractors') ?: getObject('shibboleth.authn.oidc.rp.DefaultAuthenticationResponseAuditExtractors')}" />
<bean id="IsCodeFlow" class="net.shibboleth.idp.plugin.authn.oidc.rp.config.logic.IsCodeFlowPredicate"/>
@@ -488,7 +488,7 @@
<bean
class="net.shibboleth.idp.plugin.authn.oidc.rp.metadata.impl.OIDCProviderMetadataLookupHandler"
scope="prototype" p:copyContextStrategy-ref="OutboundOIDCMetadataContextLookup"
- p:providerMetadataResolver-ref="shibboleth.oidc.rp.ProviderMetadataResolver" />
+ p:providerMetadataResolver-ref="shibboleth.authn.oidc.rp.ProviderMetadataResolver" />
<bean class="net.shibboleth.oidc.security.impl.JWTMessageSignatureSecurityHandler"
scope="prototype">
<property name="jwtTokenLookupStrategy">
@@ -669,7 +669,7 @@
<bean id="TokenResponsePopulateAuditContext" parent="shibboleth.AbstractPopulateAuditContext"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
- p:fieldExtractors="#{getObject('shibboleth.oidc.rp.TokenResponseAuditExtractors') ?: getObject('shibboleth.oidc.rp.DefaultTokenResponseAuditExtractors')}" />
+ p:fieldExtractors="#{getObject('shibboleth.authn.oidc.rp.TokenResponseAuditExtractors') ?: getObject('shibboleth.authn.oidc.rp.DefaultTokenResponseAuditExtractors')}" />
<!-- UserInfo endpoint beans -->
@@ -749,7 +749,7 @@
<bean
class="net.shibboleth.idp.plugin.authn.oidc.rp.metadata.impl.OIDCProviderMetadataLookupHandler"
scope="prototype" p:copyContextStrategy-ref="OutboundOIDCMetadataContextLookup"
- p:providerMetadataResolver-ref="shibboleth.oidc.rp.ProviderMetadataResolver" />
+ p:providerMetadataResolver-ref="shibboleth.authn.oidc.rp.ProviderMetadataResolver" />
<bean class="net.shibboleth.oidc.security.impl.JWTMessageSignatureSecurityHandler"
scope="prototype">
<property name="jwtTokenLookupStrategy">
@@ -810,20 +810,39 @@
<ref bean="AudienceClaimsValidator" />
</util:list>
+ <bean id="PostJWTUserInfoResponsePopulateAuditContext" parent="shibboleth.AbstractPopulateAuditContext"
+ p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
+ p:fieldExtractors="#{getObject('shibboleth.authn.oidc.rp.PostJWTUserInfoResponseAuditExtractors') ?: getObject('shibboleth.authn.oidc.rp.DefaultPostJWTUserInfoResponseAuditExtractors')}" />
+
+
<!-- This is a very simplified and hard coded version of the claims verification used for a JWT. Maybe look to replace -->
<bean id="ValidateUserInfoPlainResponseClaims" scope="prototype"
class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.ValidateUserInfoJSONObjectClaims"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
p:authenticationContextLookupStrategy-ref="ParentAuthenticiationContextLookup" />
+
+ <bean id="PostPlainUserInfoResponsePopulateAuditContext" parent="shibboleth.AbstractPopulateAuditContext"
+ p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
+ p:fieldExtractors="#{getObject('shibboleth.authn.oidc.rp.PostPlainUserInfoResponseAuditExtractors') ?: getObject('shibboleth.authn.oidc.rp.DefaultPostPlainUserInfoResponseAuditExtractors')}" />
+
<bean id="ProcessEndUserClaims" class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.ProcessEndUserClaims"
scope="prototype" p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
- p:authenticationContextLookupStrategy-ref="ParentAuthenticiationContextLookup" />
+ p:authenticationContextLookupStrategy-ref="ParentAuthenticiationContextLookup"
+ p:claimMergingStrategy="#{getObject('shibboleth.authn.oidc.rp.ClaimMergingStrategy') ?: getObject('shibboleth.authn.oidc.rp.DefaultClaimMergingStrategy')}"
+ p:claimSanitizationStrategy="#{getObject('shibboleth.authn.oidc.rp.ClaimSanitizationStrategy') ?: getObject('shibboleth.authn.oidc.rp.DefaultClaimSanitizationStrategy')}"/>
+
+
+ <bean id="shibboleth.authn.oidc.rp.DefaultClaimMergingStrategy"
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.DefaultClaimMergingStrategy"/>
+
+ <bean id="shibboleth.authn.oidc.rp.DefaultClaimSanitizationStrategy"
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.DefaultClaimSanitizationStrategy"/>
<bean id="PostResponsePopulateAuditContext" parent="shibboleth.AbstractPopulateAuditContext"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
- p:fieldExtractors="#{getObject('shibboleth.oidc.rp.PostResponseAuditExtractors') ?: getObject('shibboleth.oidc.rp.DefaultPostResponseAuditExtractors')}" />
+ p:fieldExtractors="#{getObject('shibboleth.authn.oidc.rp.PostResponseAuditExtractors') ?: getObject('shibboleth.authn.oidc.rp.DefaultPostResponseAuditExtractors')}" />
<bean id="CheckUserInfoPlainResponseTypeCondition"
class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic.UserInfoPlainResponseTypeCondition" />
@@ -840,7 +859,25 @@
p:attributeFilter-ref="shibboleth.AttributeFilterService"
p:transcoderRegistry-ref="shibboleth.AttributeRegistryService" />
+ <bean id="PopulateSubjectCanonicalizationContext"
+ class="net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext" scope="prototype"
+ p:availableFlows-ref="shibboleth.PostLoginSubjectCanonicalizationFlows" />
+
<bean id="UnsupportedResponseTypeAction" class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.UnsupportedResponseTypeAction"/>
+
+ <!--
+ Allows the WriteAuditLog action to be run in a transition, and a 'success' event is produced such that
+ the transition is executed.
+ -->
+ <bean id="WriteAuditLogInTransition"
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.audit.impl.TransitionActionWriteAuditLog" scope="prototype"
+ p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
+ p:formattingMap-ref="shibboleth.AuditFormattingMap"
+ p:dateTimeFormat="#{getObject('shibboleth.AuditDateTimeFormat')}"
+ p:useDefaultTimeZone="#{getObject('shibboleth.AuditDefaultTimeZone') ?: false}"
+ p:httpServletRequest-ref="shibboleth.HttpServletRequest" />
+
+
<!-- Can override one or more of the beans above. Note, the property override is mostly to allow tests
to change the location of the user config file. -->
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-flow.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-flow.xml
index f273a51..fec0e96 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-flow.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-flow.xml
@@ -160,6 +160,7 @@
<evaluate expression="PopulateUserInfoTokenSignatureValidationParameters" />
<evaluate expression="HandleUserInfoTokenValidation" />
<evaluate expression="ValidateUserInfoTokenClaims" />
+ <evaluate expression="PostJWTUserInfoResponsePopulateAuditContext" />
<evaluate expression="'proceed'" />
<transition on="proceed" to="FinalizeResponse" />
</action-state>
@@ -167,6 +168,7 @@
<!-- Plain UserInfo response types will skip straight to this stage -->
<action-state id="ValidateUserInfoPlainClaimsSet">
<evaluate expression="ValidateUserInfoPlainResponseClaims" />
+ <evaluate expression="PostPlainUserInfoResponsePopulateAuditContext" />
<evaluate expression="'proceed'" />
<transition on="proceed" to="FinalizeResponse" />
</action-state>
@@ -175,10 +177,10 @@
<evaluate expression="ProcessEndUserClaims" />
<evaluate expression="PostResponsePopulateAuditContext" />
<evaluate expression="ValidateOIDCAuthentication" />
+ <evaluate expression="PopulateSubjectCanonicalizationContext" />
<evaluate expression="WriteAuditLog" />
<evaluate expression="'proceed'" />
- <!-- Subject canonicalization -->
- <transition on="proceed" to="proceed" />
+ <transition on="proceed" to="CallSubjectCanonicalization" />
</action-state>
<!--
@@ -205,24 +207,22 @@
<transition on="proceed" to="ReselectFlow" />
</action-state>
-
- <!-- <subflow-state id="CallSubjectCanonicalization" subflow="c14n">
+ <!-- Call flow specific c14n here, and allow an error to trigger a flow reselect. -->
+ <subflow-state id="CallSubjectCanonicalization" subflow="c14n">
<input name="calledAsSubflow" value="true" />
<transition on="proceed" to="proceed" />
-
- This shouldn't generally happen, but if c14n fails, it's allowable to fall through.
- <transition on="SubjectCanonicalizationError" to="ReselectFlow" />
- </subflow-state> -->
+ <transition on="SubjectCanonicalizationError" to="ReselectFlow" />
+ </subflow-state>
+
<global-transitions>
<!-- Route everything out as a graceful failure to allow subsequent options to run. -->
<transition on="#{!'proceed'.equals(currentEvent.id)}" to="ReselectFlow">
+ <evaluate expression="WriteAuditLogInTransition"/>
<evaluate expression="T(org.opensaml.core.metrics.MetricsSupport).getMetricRegistry().counter('net.shibboleth.idp.authn.oidc.rp.failures').inc()" />
</transition>
</global-transitions>
-
-
<bean-import resource="oidc-relying-party-authn-beans.xml" />
</flow>
diff --git a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/clientinfo-resolver-system.xml b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/clientinfo-resolver-system.xml
deleted file mode 100644
index 09dfce8..0000000
--- a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/clientinfo-resolver-system.xml
+++ /dev/null
@@ -1,32 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
- xmlns:context="http://www.springframework.org/schema/context"
- xmlns:util="http://www.springframework.org/schema/util"
- xmlns:p="http://www.springframework.org/schema/p"
- xmlns:c="http://www.springframework.org/schema/c"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-
- default-init-method="initialize"
- default-destroy-method="destroy"
- default-lazy-init="true">
-
- <bean id="shibboleth.oidc.RelyingPartyClientInformationProvider" lazy-init="false"
- class="net.shibboleth.oidc.metadata.RelyingPartyClientInformationProvider"
- p:embeddedResolver-ref="shibboleth.oidc.ChainingClientInformationResolver">
- </bean>
-
- <bean id="shibboleth.oidc.ChainingClientInformationResolver"
- class="net.shibboleth.oidc.metadata.impl.ChainingClientInformationResolver"
- p:id="InternalEmbeddedChainResolver"
- p:resolvers="#{getObject('shibboleth.oidc.ClientInformationResolvers')}"/>
-
- <bean id="shibboleth.oidc.FilesystemClientInformationResolver" abstract="true"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.metadata.impl.FilesystemClientInformationResolver"/>
-
- <!-- Wildcard import hook for plugins. -->
- <!-- <import resource="classpath*:/META-INF/net/shibboleth/idp/plugin/oidc/op/service/clientinfo/postconfig.xml" /> -->
-
-</beans>
\ No newline at end of file
diff --git a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-providermetadata-resolvers.xml b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-providermetadata-resolvers.xml
new file mode 100644
index 0000000..bf31d26
--- /dev/null
+++ b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-providermetadata-resolvers.xml
@@ -0,0 +1,34 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:context="http://www.springframework.org/schema/context"
+ xmlns:util="http://www.springframework.org/schema/util" xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:c="http://www.springframework.org/schema/c" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+
+ default-init-method="initialize" default-destroy-method="destroy">
+
+ <!-- User space config -->
+
+ <util:list id="shibboleth.authn.oidc.rp.ProviderMetadataResolvers">
+ <ref bean="ProviderHTTPResolver" />
+ </util:list>
+
+ <bean id="ProviderHTTPResolver" parent="shibboleth.authn.oidc.rp.OIDCProviderMetadataResolver">
+ <constructor-arg>
+ <bean parent="shibboleth.authn.oidc.rp.CacheBuilder">
+ <constructor-arg>
+ <bean p:cacheId="ProviderHTTPDynamicResolver" parent="shibboleth.authn.oidc.rp.BaseProviderDynamicCacheBuilderSpec"
+ p:minCacheDuration="PT1M"
+ p:maxCacheDuration="PT2M"
+ p:cleanupTaskInterval="PT30S"/>
+ </constructor-arg>
+ </bean>
+ </constructor-arg>
+ </bean>
+
+
+
+
+</beans>
\ No newline at end of file
diff --git a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/rp-credentials.xml b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp-credentials.xml
similarity index 100%
rename from idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/rp-credentials.xml
rename to idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp-credentials.xml
diff --git a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/providermetadata-resolver-system.xml b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/providermetadata-resolver-system.xml
index cff8c0d..ae9274d 100644
--- a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/providermetadata-resolver-system.xml
+++ b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/providermetadata-resolver-system.xml
@@ -11,73 +11,76 @@
<!-- Loaded by the postconfig.xml file as global beans -->
- <bean id="shibboleth.oidc.rp.ProviderMetadataProvider" lazy-init="false"
+ <bean id="shibboleth.authn.oidc.rp.ProviderMetadataProvider" lazy-init="false"
class="net.shibboleth.oidc.metadata.ProviderMetadataProviderContainer"
- p:embeddedResolver-ref="shibboleth.oidc.rp.ChainingProviderMetadataResolver">
+ p:embeddedResolver-ref="shibboleth.authn.oidc.rp.ChainingProviderMetadataResolver">
</bean>
- <bean id="shibboleth.oidc.rp.ChainingProviderMetadataResolver"
+ <bean id="shibboleth.authn.oidc.rp.ChainingProviderMetadataResolver"
class="net.shibboleth.oidc.metadata.impl.ChainingProviderMetadataResolver" p:id="InternalEmbeddedChainResolver"
- p:resolvers="#{getObject('shibboleth.oidc.rp.ProviderMetadataResolvers')}" />
+ p:resolvers="#{getObject('shibboleth.authn.oidc.rp.ProviderMetadataResolvers')}" />
<!-- abstract beans for the user space config to extend -->
- <bean id="shibboleth.oidc.rp.OIDCProviderMetadataResolver" abstract="true"
+ <bean id="shibboleth.authn.oidc.rp.OIDCProviderMetadataResolver" abstract="true"
class="net.shibboleth.oidc.metadata.impl.OIDCProviderMetadataResolver" />
- <bean id="shibboleth.oidc.rp.DefaultHTTPProviderConfigurationMetadataFetchingStrategy"
- class="net.shibboleth.oidc.metadata.impl.HTTPProviderConfigurationFetchingStrategy"
+ <bean id="shibboleth.authn.oidc.rp.DefaultHTTPProviderConfigurationMetadataFetchingStrategy"
+ class="net.shibboleth.oidc.metadata.impl.HTTPProviderConfigurationFetchingStrategy"
c:client-ref="shibboleth.InternalHttpClient"
- c:handler-ref="shibboleth.oidc.rp.DefaultHTTProviderConfigurationMetadataResponseHandler" />
+ c:handler-ref="shibboleth.authn.oidc.rp.DefaultHTTProviderConfigurationMetadataResponseHandler"
+ p:wellKnownLocationCompositionStrategy="#{getObject('shibboleth.authn.oidc.rp.WellKnownLocationCompositionStrategy')}"/>
- <bean id="shibboleth.oidc.rp.DefaultHTTProviderConfigurationMetadataResponseHandler"
+
+ <bean id="shibboleth.authn.oidc.rp.DefaultHTTProviderConfigurationMetadataResponseHandler"
class="net.shibboleth.oidc.metadata.impl.HTTPProviderConfigurationFetchingStrategy.OIDCProviderMetadataResponseHandler" />
<!-- Cache builder specifications -->
<bean id="cacheFactory" class="net.shibboleth.oidc.metadata.cache.impl.MetadataCacheBuilder$Builder"/>
- <bean id="shibboleth.oidc.rp.CacheBuilder" factory-bean="cacheFactory" factory-method="build"
+ <bean id="shibboleth.authn.oidc.rp.CacheBuilder" factory-bean="cacheFactory" factory-method="build"
abstract="true"/>
+ <!-- TODO Should we even provide the batch one? -->
<bean class="net.shibboleth.oidc.metadata.cache.impl.BatchMetadataCacheBuilderSpec"
- id="shibboleth.oidc.rp.BaseProviderBatchCacheBuilderSpec" abstract="true"
- p:parsingStrategy-ref="shibboleth.oidc.rp.DefaultOIDCProviderMetadataParsingStrategy"
- p:criteriaToIdentifierStrategy-ref="shibboleth.oidc.rp.DefaultOIDCProviderMetadataCriteriaToIdentifierStrategy"
- p:sourceMetadataExpiryStrategy-ref="shibboleth.oidc.rp.DefaultODICProviderSourceMetadataExpirationTimeStrategy"
- p:identifierExtractionStrategy-ref="shibboleth.oidc.rp.DefaultOIDCProviderMetadataIdentifierExtractionStrategy"/>
+ id="shibboleth.authn.oidc.rp.BaseProviderBatchCacheBuilderSpec" abstract="true"
+ p:parsingStrategy-ref="shibboleth.authn.oidc.rp.DefaultOIDCProviderMetadataParsingStrategy"
+ p:criteriaToIdentifierStrategy-ref="shibboleth.authn.oidc.rp.DefaultOIDCProviderMetadataCriteriaToIdentifierStrategy"
+ p:sourceMetadataExpiryStrategy-ref="shibboleth.authn.oidc.rp.DefaultODICProviderSourceMetadataExpirationTimeStrategy"
+ p:identifierExtractionStrategy-ref="shibboleth.authn.oidc.rp.DefaultOIDCProviderMetadataIdentifierExtractionStrategy"/>
<bean class="net.shibboleth.oidc.metadata.cache.impl.DynamicMetadataCacheBuilderSpec"
- id="shibboleth.oidc.rp.BaseProviderDynamicCacheBuilderSpec" abstract="true"
- p:fetchStrategy-ref="shibboleth.oidc.rp.DefaultHTTPProviderConfigurationMetadataFetchingStrategy"
- p:criteriaToIdentifierStrategy-ref="shibboleth.oidc.rp.DefaultOIDCProviderMetadataCriteriaToIdentifierStrategy"
- p:metadataExpirationTimeStrategy-ref="shibboleth.oidc.rp.DefaultODICProviderMetadataExpirationTimeStrategy"
- p:identifierExtractionStrategy-ref="shibboleth.oidc.rp.DefaultOIDCProviderMetadataIdentifierExtractionStrategy"
+ id="shibboleth.authn.oidc.rp.BaseProviderDynamicCacheBuilderSpec" abstract="true"
+ p:fetchStrategy-ref="shibboleth.authn.oidc.rp.DefaultHTTPProviderConfigurationMetadataFetchingStrategy"
+ p:criteriaToIdentifierStrategy-ref="shibboleth.authn.oidc.rp.DefaultOIDCProviderMetadataCriteriaToIdentifierStrategy"
+ p:metadataExpirationTimeStrategy-ref="shibboleth.authn.oidc.rp.DefaultODICProviderMetadataExpirationTimeStrategy"
+ p:identifierExtractionStrategy-ref="shibboleth.authn.oidc.rp.DefaultOIDCProviderMetadataIdentifierExtractionStrategy"
/>
<!-- Common parents for cache strategy implementations -->
- <bean id="shibboleth.oidc.rp.ProviderConfigurationMetadataFileLoadingStrategy"
+ <bean id="shibboleth.authn.oidc.rp.ProviderConfigurationMetadataFileLoadingStrategy"
class="net.shibboleth.oidc.metadata.cache.impl.DefaultFileLoadingStrategy" abstract="true"/>
<!-- Common implementation strategies for cache implementations -->
- <bean id="shibboleth.oidc.rp.DefaultOIDCProviderMetadataParsingStrategy" scope="prototype"
+ <bean id="shibboleth.authn.oidc.rp.DefaultOIDCProviderMetadataParsingStrategy" scope="prototype"
class="net.shibboleth.oidc.metadata.cache.impl.DefaultOIDCProviderMetadataParsingStrategy" />
- <bean id="shibboleth.oidc.rp.DefaultMapParsingStrategy" scope="prototype"
+ <bean id="shibboleth.authn.oidc.rp.DefaultMapParsingStrategy" scope="prototype"
class="net.shibboleth.oidc.metadata.cache.impl.DefaultJSONMapParsingStrategy" />
- <bean id="shibboleth.oidc.rp.DefaultODICProviderMetadataExpirationTimeStrategy" scope="prototype"
+ <bean id="shibboleth.authn.oidc.rp.DefaultODICProviderMetadataExpirationTimeStrategy" scope="prototype"
class="net.shibboleth.oidc.metadata.cache.impl.DefaultOIDCProviderMetadataExpirationTimeStrategy"/>
- <bean id="shibboleth.oidc.rp.DefaultODICProviderSourceMetadataExpirationTimeStrategy" scope="prototype"
+ <bean id="shibboleth.authn.oidc.rp.DefaultODICProviderSourceMetadataExpirationTimeStrategy" scope="prototype"
class="net.shibboleth.oidc.metadata.cache.impl.DefaultSourceMetadataExpirationTimeStrategy"
c:duration="PT10M" />
- <bean id="shibboleth.oidc.rp.DefaultOIDCProviderMetadataIdentifierExtractionStrategy" scope="prototype"
+ <bean id="shibboleth.authn.oidc.rp.DefaultOIDCProviderMetadataIdentifierExtractionStrategy" scope="prototype"
class="net.shibboleth.oidc.metadata.cache.impl.DefaultOIDCProviderMetadataIdentifierExtractionStrategy" />
- <bean id="shibboleth.oidc.rp.DefaultOIDCProviderMetadataCriteriaToIdentifierStrategy" scope="prototype"
+ <bean id="shibboleth.authn.oidc.rp.DefaultOIDCProviderMetadataCriteriaToIdentifierStrategy" scope="prototype"
class="net.shibboleth.oidc.metadata.cache.impl.DefaultOIDCProviderMetadataCriteriaToIdentifierStrategy" />
<!-- Wildcard import hook for plugins. -->
diff --git a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/module.properties b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/module.properties
index 1926077..0830f88 100644
--- a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/module.properties
+++ b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/module.properties
@@ -1,14 +1,14 @@
# Example Properties defining an authentication module.
# Class to Module ID mappings
-net.shibboleth.idp.plugin.authn.oidc.rp.OIDCRPModule = idp.authn.java-idp-oidc-rp
+net.shibboleth.idp.plugin.authn.oidc.rp.OIDCRPModule = idp.authn.oidc.RP
# Module Owner
-idp.authn.java-idp-oidc-rp.plugin = net.shibboleth.idp.plugin.authn.java-idp-oidc-rp
+idp.authn.oidc.RP.plugin = net.shibboleth.idp.plugin.authn.oidc.rp
-idp.authn.java-idp-oidc-rp.name = java-idp-oidc-rp Authentication
-idp.authn.java-idp-oidc-rp.desc = Login flow for java-idp-oidc-rp
-idp.authn.java-idp-oidc-rp.url = /java-idp-oidc-rpConfiguration
-idp.authn.java-idp-oidc-rp.1.src = somefile
-idp.authn.java-idp-oidc-rp.1.dest = conf/to-somefile
-idp.authn.java-idp-oidc-rp.1.replace = true
+idp.authn.oidc.RP.name = OpenID Relying Party
+idp.authn.oidc.RP.desc = Login flow for java-idp-oidc-rp
+idp.authn.oidc.RP.url = /java-idp-oidc-rpConfiguration
+idp.authn.oidc.RP.1.src = somefile
+idp.authn.oidc.RP.1.dest = conf/to-somefile
+idp.authn.oidc.RP.1.replace = true
diff --git a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/plugin.properties b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/plugin.properties
index c4407d2..3f9f924 100644
--- a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/plugin.properties
+++ b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/plugin.properties
@@ -1,6 +1,6 @@
# Example properties defining this plugin
-plugin.id = net.shibboleth.idp.plugin.authn.oidc.rp.OIDCRPPlugin
+plugin.id = net.shibboleth.idp.plugin.authn.oidc.rp
# Only used when package manifest is not available
plugin.version = 0.0.1
#plugin.license = licence.txt
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java
index 2d12e67..b121ec2 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java
@@ -332,7 +332,7 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
// Add a signing key incase it is used
loadBeanDefinitionsFromXmlFile(builderContext,
- new ClassPathResource("conf/authn/rp-credentials.xml"), Map.of(
+ new ClassPathResource("conf/authn/oidc-rp-credentials.xml"), Map.of(
"idp.authn.oidc.rp.client.clientId", CLIENT_ID,
"idp.authn.oidc.rp.client.clientSecret",CLIENT_SECRET,
"idp.authn.oidc.rp.client.sig.key","conf/credentials/idp-signing-rsa.jwk"));
diff --git a/idp-oidc-rp-impl/src/test/resources/conf/audit.xml b/idp-oidc-rp-impl/src/test/resources/conf/audit.xml
index 8c78cb3..fac2c1e 100644
--- a/idp-oidc-rp-impl/src/test/resources/conf/audit.xml
+++ b/idp-oidc-rp-impl/src/test/resources/conf/audit.xml
@@ -33,7 +33,7 @@
<!-- This is not the default logging format in a normal install! -->
<util:map id="shibboleth.AuditFormattingMap">
- <entry key="Shibboleth-Audit" value="%a|%ST|%T|%u|%SP|%i|%ac|%AF|%t|%attr|%n|%f|%SSO|%XX|%XA|%b|%bb|%e|%S|%SS|%s|%UA|%DEST|%RS|%RDURI|%fauth|%RESPT|%RESPM|%scope|%ACRS|%AUTHZR|%aud|%t|%SUBUI" />
+ <entry key="Shibboleth-Audit" value="%a|%ST|%T|%AUTHNFS|%u|%SP|%i|%ac|%AF|%t|%attr|%n|%f|%SSO|%XX|%XA|%b|%bb|%e|%S|%SS|%s|%UA|%DEST|%RS|%RDURI|%fauth|%RESPT|%RESPM|%scope|%ACRS|%AUTHNR|%aud|%t|%SUBUI" />
</util:map>
<!-- Override the format of date/time fields in the log and/or convert to default time zone. -->
diff --git a/idp-oidc-rp-impl/src/test/resources/conf/authn/oidc-providermetadata-resolvers.xml b/idp-oidc-rp-impl/src/test/resources/conf/authn/oidc-providermetadata-resolvers.xml
index 4f5bd93..558c3de 100644
--- a/idp-oidc-rp-impl/src/test/resources/conf/authn/oidc-providermetadata-resolvers.xml
+++ b/idp-oidc-rp-impl/src/test/resources/conf/authn/oidc-providermetadata-resolvers.xml
@@ -17,11 +17,11 @@
</util:list>
- <bean id="ExampleHTTPResolver" parent="shibboleth.oidc.rp.OIDCProviderMetadataResolver">
+ <bean id="ExampleHTTPResolver" parent="shibboleth.authn.oidc.rp.OIDCProviderMetadataResolver">
<constructor-arg>
- <bean parent="shibboleth.oidc.rp.CacheBuilder">
+ <bean parent="shibboleth.authn.oidc.rp.CacheBuilder">
<constructor-arg>
- <bean p:cacheId="ExampleHTTPDynamicResolver" parent="shibboleth.oidc.rp.BaseProviderDynamicCacheBuilderSpec"
+ <bean p:cacheId="ExampleHTTPDynamicResolver" parent="shibboleth.authn.oidc.rp.BaseProviderDynamicCacheBuilderSpec"
p:minCacheDuration="PT1M"
p:maxCacheDuration="PT2M"
p:cleanupTaskInterval="PT30S"/>
diff --git a/idp-oidc-rp-impl/src/test/resources/conf/authn/rp-credentials.xml b/idp-oidc-rp-impl/src/test/resources/conf/authn/oidc-rp-credentials.xml
similarity index 100%
rename from idp-oidc-rp-impl/src/test/resources/conf/authn/rp-credentials.xml
rename to idp-oidc-rp-impl/src/test/resources/conf/authn/oidc-rp-credentials.xml
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list