[java-idp-plugin-oidc-rp] branch main updated: Support new OIDC security config and cleanup code
Phil Smart
philip.smart at jisc.ac.uk
Tue Sep 27 15:14:16 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=a32fc4b1fe9f395e528867ab33d7c32256f4283a
The following commit(s) were added to refs/heads/main by this push:
new a32fc4b Support new OIDC security config and cleanup code
a32fc4b is described below
commit a32fc4b1fe9f395e528867ab33d7c32256f4283a
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Tue Sep 27 16:14:11 2022 +0100
Support new OIDC security config and cleanup code
- Support simplified OIDC Security config
- Javadoc cleanup
- Logging cleanup
- Test cleanup
---
...TokenDecryptionConfigurationLookupFunction.java | 8 +--
...atureValidationConfigurationLookupFunction.java | 20 +++---
...bjectEncryptionConfigurationLookupFunction.java | 10 +--
...ignatureSigningConfigurationLookupFunction.java | 11 ++--
...rInfoDecryptionConfigurationLookupFunction.java | 8 +--
...atureValidationConfigurationLookupFunction.java | 20 +++---
.../authn/oidc/rp/impl/AddRequestedClaims.java | 2 +-
.../idp/plugin/authn/oidc/rp/impl/DecryptJWT.java | 2 +-
...RelyingPartyProxySigningParametersResolver.java | 7 +-
.../oidc-relying-party-authn-beans.xml | 12 ++--
.../idp/service/relying-party/postconfig.xml | 39 +++++-------
.../authn/oidc/rp/conf/authn/oidc-rp.properties | 65 ++++++++++++++-----
.../plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java | 74 ++++++++--------------
...ingPartyProxySigningParametersResolverTest.java | 25 ++++----
.../plugin/authn/oidc/rp/impl/TestTokenHelper.java | 10 ++-
15 files changed, 161 insertions(+), 152 deletions(-)
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/IDTokenDecryptionConfigurationLookupFunction.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/IDTokenDecryptionConfigurationLookupFunction.java
index bbb601f..955d1e7 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/IDTokenDecryptionConfigurationLookupFunction.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/IDTokenDecryptionConfigurationLookupFunction.java
@@ -68,9 +68,9 @@ public class IDTokenDecryptionConfigurationLookupFunction
final ProfileConfiguration pc = rpc.getProfileConfig();
if (pc != null && pc.getSecurityConfiguration(input) instanceof OIDCSecurityConfiguration
&& ((OIDCSecurityConfiguration) pc.getSecurityConfiguration(input))
- .getIdtokenJwtDecryptionConfiguration() != null) {
+ .getJwtDecryptionConfiguration() != null) {
configs.add(((OIDCSecurityConfiguration) pc.getSecurityConfiguration(input))
- .getIdtokenJwtDecryptionConfiguration());
+ .getJwtDecryptionConfiguration());
}
}
@@ -80,9 +80,9 @@ public class IDTokenDecryptionConfigurationLookupFunction
rpResolver.getDefaultSecurityConfiguration(input.getProfileId());
if (defaultConfig instanceof OIDCSecurityConfiguration
&& ((OIDCSecurityConfiguration) defaultConfig)
- .getIdtokenJwtDecryptionConfiguration() != null) {
+ .getJwtDecryptionConfiguration() != null) {
configs.add(
- ((OIDCSecurityConfiguration) defaultConfig).getIdtokenJwtDecryptionConfiguration());
+ ((OIDCSecurityConfiguration) defaultConfig).getJwtDecryptionConfiguration());
}
}
// TODO: Support for Global Default configuration?
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/IDTokenSignatureValidationConfigurationLookupFunction.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/IDTokenSignatureValidationConfigurationLookupFunction.java
index 75928d4..7853405 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/IDTokenSignatureValidationConfigurationLookupFunction.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/IDTokenSignatureValidationConfigurationLookupFunction.java
@@ -24,18 +24,16 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
-import com.nimbusds.jwt.SignedJWT;
-
import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.config.SecurityConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
import net.shibboleth.idp.relyingparty.RelyingPartyConfigurationResolver;
import net.shibboleth.oidc.profile.config.OIDCSecurityConfiguration;
-import net.shibboleth.oidc.security.SignatureValidationConfiguration;
+import net.shibboleth.oidc.security.JWTSignatureValidationConfiguration;
/**
- * A function that returns a {@link SignatureValidationConfiguration} list for id_token signature validation by way
+ * A function that returns a {@link JWTSignatureValidationConfiguration} list for id_token signature validation by way
* of various lookup strategies.
*
* <p>
@@ -43,7 +41,7 @@ import net.shibboleth.oidc.security.SignatureValidationConfiguration;
* </p>
*/
public class IDTokenSignatureValidationConfigurationLookupFunction
- extends AbstractRelyingPartyLookupFunction<List<SignatureValidationConfiguration<SignedJWT>>> {
+ extends AbstractRelyingPartyLookupFunction<List<JWTSignatureValidationConfiguration>> {
/** A resolver for default security configurations. */
@Nullable
@@ -61,18 +59,18 @@ public class IDTokenSignatureValidationConfigurationLookupFunction
/** {@inheritDoc} */
@Override
@Nullable
- public List<SignatureValidationConfiguration<SignedJWT>> apply(@Nullable final ProfileRequestContext input) {
+ public List<JWTSignatureValidationConfiguration> apply(@Nullable final ProfileRequestContext input) {
- final List<SignatureValidationConfiguration<SignedJWT>> configs = new ArrayList<>();
+ final List<JWTSignatureValidationConfiguration> configs = new ArrayList<>();
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
if (pc != null && pc.getSecurityConfiguration(input) instanceof OIDCSecurityConfiguration
&& ((OIDCSecurityConfiguration) pc.getSecurityConfiguration(input))
- .getIdTokenJwtSignatureValidationConfiguration() != null) {
+ .getJwtSignatureValidationConfiguration() != null) {
configs.add(((OIDCSecurityConfiguration) pc.getSecurityConfiguration(input))
- .getIdTokenJwtSignatureValidationConfiguration());
+ .getJwtSignatureValidationConfiguration());
}
}
@@ -82,9 +80,9 @@ public class IDTokenSignatureValidationConfigurationLookupFunction
rpResolver.getDefaultSecurityConfiguration(input.getProfileId());
if (defaultConfig instanceof OIDCSecurityConfiguration
&& ((OIDCSecurityConfiguration) defaultConfig)
- .getIdTokenJwtSignatureValidationConfiguration() != null) {
+ .getJwtSignatureValidationConfiguration() != null) {
configs.add(
- ((OIDCSecurityConfiguration) defaultConfig).getIdTokenJwtSignatureValidationConfiguration());
+ ((OIDCSecurityConfiguration) defaultConfig).getJwtSignatureValidationConfiguration());
}
}
// TODO: Support for Global Default configuration?
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/RequestObjectEncryptionConfigurationLookupFunction.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/RequestObjectEncryptionConfigurationLookupFunction.java
index b0ebd76..33dd089 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/RequestObjectEncryptionConfigurationLookupFunction.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/RequestObjectEncryptionConfigurationLookupFunction.java
@@ -34,7 +34,7 @@ import net.shibboleth.oidc.profile.config.OIDCSecurityConfiguration;
import net.shibboleth.oidc.security.JWTEncryptionConfiguration;
/**
- * A function that returns an {@link EncryptionConfiguration} list for request object encryption by way
+ * A function that returns an {@link JWTEncryptionConfiguration} list for request object encryption by way
* of various lookup strategies.
*
* <p>
@@ -69,9 +69,9 @@ public class RequestObjectEncryptionConfigurationLookupFunction
final ProfileConfiguration pc = rpc.getProfileConfig();
if (pc != null && pc.getSecurityConfiguration(input) instanceof OIDCSecurityConfiguration
&& ((OIDCSecurityConfiguration) pc.getSecurityConfiguration(input))
- .getRequestObjectEncryptionConfig() != null) {
+ .getJwtEncryptionConfiguration() != null) {
configs.add(((OIDCSecurityConfiguration) pc.getSecurityConfiguration(input))
- .getRequestObjectEncryptionConfig());
+ .getJwtEncryptionConfiguration());
}
}
@@ -81,9 +81,9 @@ public class RequestObjectEncryptionConfigurationLookupFunction
rpResolver.getDefaultSecurityConfiguration(input.getProfileId());
if (defaultConfig instanceof OIDCSecurityConfiguration
&& ((OIDCSecurityConfiguration) defaultConfig)
- .getRequestObjectEncryptionConfig() != null) {
+ .getJwtEncryptionConfiguration() != null) {
configs.add(
- ((OIDCSecurityConfiguration) defaultConfig).getRequestObjectEncryptionConfig());
+ ((OIDCSecurityConfiguration) defaultConfig).getJwtEncryptionConfiguration());
}
}
// TODO: Support for Global Default configuration?
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/RequestObjectSignatureSigningConfigurationLookupFunction.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/RequestObjectSignatureSigningConfigurationLookupFunction.java
index 1b3d687..bc264e6 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/RequestObjectSignatureSigningConfigurationLookupFunction.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/RequestObjectSignatureSigningConfigurationLookupFunction.java
@@ -23,7 +23,6 @@ import java.util.List;
import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.xmlsec.SignatureSigningConfiguration;
import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.config.SecurityConfiguration;
@@ -34,7 +33,7 @@ import net.shibboleth.oidc.profile.config.OIDCSecurityConfiguration;
import net.shibboleth.oidc.security.JWTSignatureSigningConfiguration;
/**
- * A function that returns a {@link SignatureSigningConfiguration} list for request object signing by way
+ * A function that returns a {@link JWTSignatureSigningConfiguration} list for request object signing by way
* of various lookup strategies.
*
* <p>
@@ -69,9 +68,9 @@ public class RequestObjectSignatureSigningConfigurationLookupFunction
final ProfileConfiguration pc = rpc.getProfileConfig();
if (pc != null && pc.getSecurityConfiguration(input) instanceof OIDCSecurityConfiguration
&& ((OIDCSecurityConfiguration) pc.getSecurityConfiguration(input))
- .getRequestObjectSignatureSigningConfiguration() != null) {
+ .getJwtSignatureSigningConfiguration() != null) {
configs.add(((OIDCSecurityConfiguration) pc.getSecurityConfiguration(input))
- .getRequestObjectSignatureSigningConfiguration());
+ .getJwtSignatureSigningConfiguration());
}
}
@@ -81,9 +80,9 @@ public class RequestObjectSignatureSigningConfigurationLookupFunction
rpResolver.getDefaultSecurityConfiguration(input.getProfileId());
if (defaultConfig instanceof OIDCSecurityConfiguration
&& ((OIDCSecurityConfiguration) defaultConfig)
- .getRequestObjectSignatureSigningConfiguration() != null) {
+ .getJwtSignatureSigningConfiguration() != null) {
configs.add(
- ((OIDCSecurityConfiguration) defaultConfig).getRequestObjectSignatureSigningConfiguration());
+ ((OIDCSecurityConfiguration) defaultConfig).getJwtSignatureSigningConfiguration());
}
}
// TODO: Support for Global Default configuration?
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/UserInfoDecryptionConfigurationLookupFunction.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/UserInfoDecryptionConfigurationLookupFunction.java
index 908c65b..847c754 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/UserInfoDecryptionConfigurationLookupFunction.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/UserInfoDecryptionConfigurationLookupFunction.java
@@ -68,9 +68,9 @@ public class UserInfoDecryptionConfigurationLookupFunction
final ProfileConfiguration pc = rpc.getProfileConfig();
if (pc != null && pc.getSecurityConfiguration(input) instanceof OIDCSecurityConfiguration
&& ((OIDCSecurityConfiguration) pc.getSecurityConfiguration(input))
- .getUserInfoJwtDecryptionConfiguration() != null) {
+ .getJwtDecryptionConfiguration() != null) {
configs.add(((OIDCSecurityConfiguration) pc.getSecurityConfiguration(input))
- .getUserInfoJwtDecryptionConfiguration());
+ .getJwtDecryptionConfiguration());
}
}
@@ -80,9 +80,9 @@ public class UserInfoDecryptionConfigurationLookupFunction
rpResolver.getDefaultSecurityConfiguration(input.getProfileId());
if (defaultConfig instanceof OIDCSecurityConfiguration
&& ((OIDCSecurityConfiguration) defaultConfig)
- .getUserInfoJwtDecryptionConfiguration() != null) {
+ .getJwtDecryptionConfiguration() != null) {
configs.add(
- ((OIDCSecurityConfiguration) defaultConfig).getUserInfoJwtDecryptionConfiguration());
+ ((OIDCSecurityConfiguration) defaultConfig).getJwtDecryptionConfiguration());
}
}
// TODO: Support for Global Default configuration?
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/UserInfoTokenSignatureValidationConfigurationLookupFunction.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/UserInfoTokenSignatureValidationConfigurationLookupFunction.java
index 5c2b766..be202e4 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/UserInfoTokenSignatureValidationConfigurationLookupFunction.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/UserInfoTokenSignatureValidationConfigurationLookupFunction.java
@@ -24,18 +24,16 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
-import com.nimbusds.jwt.SignedJWT;
-
import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.config.SecurityConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
import net.shibboleth.idp.relyingparty.RelyingPartyConfigurationResolver;
import net.shibboleth.oidc.profile.config.OIDCSecurityConfiguration;
-import net.shibboleth.oidc.security.SignatureValidationConfiguration;
+import net.shibboleth.oidc.security.JWTSignatureValidationConfiguration;
/**
- * A function that returns a {@link SignatureValidationConfiguration} list for UserInfo token signature validation
+ * A function that returns a {@link JWTSignatureValidationConfiguration} list for UserInfo token signature validation
* by way of various lookup strategies.
*
* <p>
@@ -43,7 +41,7 @@ import net.shibboleth.oidc.security.SignatureValidationConfiguration;
* </p>
*/
public class UserInfoTokenSignatureValidationConfigurationLookupFunction
- extends AbstractRelyingPartyLookupFunction<List<SignatureValidationConfiguration<SignedJWT>>> {
+ extends AbstractRelyingPartyLookupFunction<List<JWTSignatureValidationConfiguration>> {
/** A resolver for default security configurations. */
@Nullable
@@ -61,18 +59,18 @@ public class UserInfoTokenSignatureValidationConfigurationLookupFunction
/** {@inheritDoc} */
@Override
@Nullable
- public List<SignatureValidationConfiguration<SignedJWT>> apply(@Nullable final ProfileRequestContext input) {
+ public List<JWTSignatureValidationConfiguration> apply(@Nullable final ProfileRequestContext input) {
- final List<SignatureValidationConfiguration<SignedJWT>> configs = new ArrayList<>();
+ final List<JWTSignatureValidationConfiguration> configs = new ArrayList<>();
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
if (pc != null && pc.getSecurityConfiguration(input) instanceof OIDCSecurityConfiguration
&& ((OIDCSecurityConfiguration) pc.getSecurityConfiguration(input))
- .getUserInfoTokenJwtSignatureValidationConfiguration() != null) {
+ .getJwtSignatureValidationConfiguration() != null) {
configs.add(((OIDCSecurityConfiguration) pc.getSecurityConfiguration(input))
- .getUserInfoTokenJwtSignatureValidationConfiguration());
+ .getJwtSignatureValidationConfiguration());
}
}
@@ -82,10 +80,10 @@ public class UserInfoTokenSignatureValidationConfigurationLookupFunction
rpResolver.getDefaultSecurityConfiguration(input.getProfileId());
if (defaultConfig instanceof OIDCSecurityConfiguration
&& ((OIDCSecurityConfiguration) defaultConfig)
- .getUserInfoTokenJwtSignatureValidationConfiguration() != null) {
+ .getJwtSignatureValidationConfiguration() != null) {
configs.add(
((OIDCSecurityConfiguration) defaultConfig)
- .getUserInfoTokenJwtSignatureValidationConfiguration());
+ .getJwtSignatureValidationConfiguration());
}
}
// TODO: Support for Global Default configuration?
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddRequestedClaims.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddRequestedClaims.java
index 855edcd..4be3ca6 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddRequestedClaims.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddRequestedClaims.java
@@ -73,7 +73,7 @@ public class AddRequestedClaims extends AbstractOIDCAuthenticationRequestAction
}
if (!getProviderMetadata().supportsClaimsParam()) {
- log.trace("{} Downstream OpenID Provider does not support the 'claims' parameter", getLogPrefix());
+ log.trace("{} OpenID Provider does not support the 'claims' parameter", getLogPrefix());
return false;
}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/DecryptJWT.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/DecryptJWT.java
index 0b176a1..5afc792 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/DecryptJWT.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/DecryptJWT.java
@@ -139,7 +139,7 @@ public class DecryptJWT extends AbstractProfileAction {
encryptedJwt = jwtTokenLookupStrategy.apply(profileRequestContext);
if (encryptedJwt == null) {
- log.debug("{} Extracted JWT was not an EncryptedJwt, nothing to decrypt",
+ log.debug("{} JWT was not an Encrypted, nothing to decrypt",
getLogPrefix());
return false;
}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/RelyingPartyProxySigningParametersResolver.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/RelyingPartyProxySigningParametersResolver.java
index a43fd15..e4ed289 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/RelyingPartyProxySigningParametersResolver.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/RelyingPartyProxySigningParametersResolver.java
@@ -113,7 +113,8 @@ public class RelyingPartyProxySigningParametersResolver extends BasicJWTSignatur
allCredentials.addAll(getEffectiveSigningCredentials(criteria));
// Get effective signature algorithms from configuration and include/exclude predicate
- final List<String> algorithms = getEffectiveSignatureAlgorithms(criteria, includeExcludePredicate);
+ final List<String> algorithms = getEffectiveSignatureAlgorithms(criteria, includeExcludePredicate);
+ log.debug("Resolved effectice signature algorithms from config: '{}'", algorithms);
// Filter by those supported by the downstream OP
final List<String> filteredAlgorithms = filterForProviderSupportedAlgorithms(criteria, algorithms);
@@ -199,8 +200,8 @@ public class RelyingPartyProxySigningParametersResolver extends BasicJWTSignatur
}
/**
- * Filter the set of algorithms against the set supported by the downstream OP.
- * Always returns a new list reference.
+ * Filter the set of algorithms against the set supported by the upstream OP.
+ * Always returns a new list reference. The ordering of the input algorithms should be preserved.
*
* @param criteria the criteria to extract the OP's metadata from to check supported algorithms.
* @param algorithms the current set of supported algorithms
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
index 8bb3e52..72ae80c 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
@@ -177,7 +177,7 @@
p:relyingPartyContextLookupStrategy-ref="shibboleth.ChildLookup.RelyingParty"/>
<bean id="PopulateRequestObjectSignatureSigningParameters" scope="prototype"
- class="net.shibboleth.oidc.security.impl.PopulateJWTSignatureSigningParameters"
+ class="net.shibboleth.oidc.profile.impl.PopulateJWTSignatureSigningParameters"
c:strategy-ref="shibboleth.ChildLookup.Proxy.MessageContextLookup.Inbound"
p:noResultIsError="true"
p:configurationLookupStrategy-ref="RequestObjectSignatureSigningConfigurationLookup"
@@ -210,7 +210,7 @@
class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.RequestObjectEncryptionConfigurationLookupFunction"
p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
- <!-- Should the resolvers move to the post-config as they are global singletons -->
+ <!-- TODO Should the resolvers move to the post-config as they are global singletons -->
<bean id="shibboleth.authn.oidc.rp.EncryptionParametersResolver"
class="net.shibboleth.oidc.security.impl.DefaultJWTEncryptionParametersResolver">
<property name="keyTransportEncryptionAlgorithmsLookupStrategy">
@@ -464,7 +464,7 @@
<bean id="PopulateIDTokenSignatureValidationParameters" parent="NestedWebFlowProfileActionAdaptor"
scope="prototype">
<constructor-arg>
- <bean class="net.shibboleth.oidc.security.impl.PopulateJWTSignatureValidationParameters"
+ <bean class="net.shibboleth.oidc.profile.impl.PopulateJWTSignatureValidationParameters"
c:strategy-ref="shibboleth.MessageContextLookup.Inbound"
p:configurationLookupStrategy-ref="shibboleth.authn.oidc.rp.IDTokenSignatureValidationConfigurationLookup"
p:signatureValidationParametersResolver-ref="shibboleth.authn.oidc.rp.IDTokenJwtSignatureValidationParametersResolver" />
@@ -472,7 +472,7 @@
</bean>
<bean id="shibboleth.authn.oidc.rp.IDTokenJwtSignatureValidationParametersResolver"
- class="net.shibboleth.oidc.security.impl.OIDCProviderConfigurationSignatureValidationParametersResolver" />
+ class="net.shibboleth.oidc.security.impl.BasicJWTSignatureValidationParametersResolver" />
<bean id="shibboleth.authn.oidc.rp.IDTokenSignatureValidationConfigurationLookup"
class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.IDTokenSignatureValidationConfigurationLookupFunction"
@@ -725,7 +725,7 @@
<bean id="PopulateUserInfoTokenSignatureValidationParameters" parent="NestedWebFlowProfileActionAdaptor"
scope="prototype">
<constructor-arg>
- <bean class="net.shibboleth.oidc.security.impl.PopulateJWTSignatureValidationParameters"
+ <bean class="net.shibboleth.oidc.profile.impl.PopulateJWTSignatureValidationParameters"
c:strategy-ref="shibboleth.MessageContextLookup.Inbound"
p:configurationLookupStrategy-ref="UserInfoTokenSignatureValidationConfigurationLookup"
p:signatureValidationParametersResolver-ref="UserInfoTokenJwtSignatureValidationParametersResolver" />
@@ -733,7 +733,7 @@
</bean>
<bean id="UserInfoTokenJwtSignatureValidationParametersResolver"
- class="net.shibboleth.oidc.security.impl.OIDCProviderConfigurationSignatureValidationParametersResolver" />
+ class="net.shibboleth.oidc.security.impl.BasicJWTSignatureValidationParametersResolver" />
<bean id="UserInfoTokenSignatureValidationConfigurationLookup"
class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.UserInfoTokenSignatureValidationConfigurationLookupFunction"
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index 611faff..e4eb51d 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -66,7 +66,7 @@
signatures and loads the default credentials used.
-->
<bean id="shibboleth.authn.oidc.rp.BasicSignatureValidationConfiguration" abstract="true"
- class="net.shibboleth.oidc.security.impl.BasicSignatureValidationConfiguration"
+ class="net.shibboleth.oidc.security.impl.BasicJWTSignatureValidationConfiguration"
p:includedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.IncludedSignatureAlgorithms')}"
p:excludedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.ExcludedSignatureAlgorithms')}" />
@@ -88,29 +88,21 @@
<bean id="shibboleth.authn.oidc.rp.DefaultSecurityConfiguration"
class="net.shibboleth.oidc.profile.config.OIDCSecurityConfiguration">
- <property name="idTokenJwtDecryptionConfiguration">
+ <property name="jwtDecryptionConfiguration">
<ref
bean="#{'%{idp.authn.oidc.rp.idtoken.decrypt.config:shibboleth.authn.oidc.rp.DefaultJWTDecryptionConfiguration}'.trim()}" />
</property>
- <property name="idTokenJwtSignatureValidationConfiguration">
+ <property name="jwtSignatureValidationConfiguration">
<ref
bean="#{'%{idp.authn.oidc.rp.idtoken.valid.config:shibboleth.authn.oidc.rp.DefaultJWTSignatureValidationConfiguration}'.trim()}" />
- </property>
- <property name="userInfoJwtDecryptionConfiguration">
- <ref
- bean="#{'%{idp.authn.oidc.rp.userinfotoken.decrypt.config:shibboleth.authn.oidc.rp.DefaultJWTDecryptionConfiguration}'.trim()}" />
- </property>
- <property name="userInfoTokenJwtSignatureValidationConfiguration">
+ </property>
+ <property name="jwtSignatureSigningConfiguration">
<ref
- bean="#{'%{idp.authn.oidc.rp.userinfotoken.valid.config:shibboleth.authn.oidc.rp.DefaultJWTSignatureValidationConfiguration}'.trim()}" />
+ bean="#{'%{idp.authn.oidc.rp.requestobject.signing.config:shibboleth.authn.oidc.rp.DefaultJWTSigningConfiguration}'.trim()}" />
</property>
- <property name="requestObjectSignatureSigningConfiguration">
+ <property name="jwtEncryptionConfiguration">
<ref
- bean="#{'%{idp.authn.oidc.rp.requestobject.signing.config:shibboleth.authn.oidc.rp.DefaultRequestObjectSigningConfiguration}'.trim()}" />
- </property>
- <property name="requestObjectEncryptionConfiguration">
- <ref
- bean="#{'%{idp.authn.oidc.rp.requestobject.encryption.config:shibboleth.authn.oidc.rp.DefaultRequestObjectEncryptionConfiguration}'.trim()}" />
+ bean="#{'%{idp.authn.oidc.rp.requestobject.encryption.config:shibboleth.authn.oidc.rp.DefaultJWTEncryptionConfiguration}'.trim()}" />
</property>
</bean>
@@ -118,7 +110,7 @@
See https://openid.net/specs/openid-connect-core-1_0.html#Encryption. But encryption is either based
on published OP keys, or the client_secret, so we can not allow abitrarily configured keys
-->
- <bean id="shibboleth.authn.oidc.rp.DefaultRequestObjectEncryptionConfiguration"
+ <bean id="shibboleth.authn.oidc.rp.DefaultJWTEncryptionConfiguration"
parent="shibboleth.authn.oidc.rp.BasicEncryptionConfiguration"
p:KEKCredentialResolver-ref="defaultOIDCRPKeyEncryptionCredentialResolver"
p:contentEncryptionKeyCredentialResolver-ref="defaultOIDCRPContentEncryptionKeyCredentialResolver">
@@ -134,7 +126,8 @@
static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_128_KW" />
<util:constant
static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_192_KW" />
-
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_256_KW" />
<util:constant
static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_128_GCM_KW" />
<util:constant
@@ -142,9 +135,7 @@
<util:constant
static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_256_GCM_KW" />
<util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_ECDH_ES" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_256_KW" />
+ static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_ECDH_ES" />
</list>
</property>
<property name="dataEncryptionAlgorithms">
@@ -165,7 +156,7 @@
</property>
</bean>
- <bean id="shibboleth.authn.oidc.rp.DefaultRequestObjectSigningConfiguration"
+ <bean id="shibboleth.authn.oidc.rp.DefaultJWTSigningConfiguration"
parent="shibboleth.authn.oidc.rp.BasicSignatureSigningConfiguration"
p:signingCredentials-ref="shibboleth.authn.oidc.rp.SigningCredentials">
<property name="signatureAlgorithms">
@@ -215,6 +206,8 @@
c:credentials-ref="shibboleth.authn.oidc.rp.DefaultKeyEncryptionCredentials" />
</constructor-arg>
</bean>
+ <bean id="CriterionCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.CriterionCredentialResolver" />
</list>
</constructor-arg>
</bean>
@@ -282,7 +275,7 @@
</constructor-arg>
</bean>
- <!-- A resolver for resolving credentials out of the JOSE header of JWTs -->
+ <!-- A resolver for resolving 'untrusted' credentials out of the JOSE header of JWTs -->
<bean id="defaultSignedJWTJOSEHeaderCredentialResolver"
class="net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver" />
diff --git a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp.properties b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp.properties
index 3ac15e4..33b61f7 100644
--- a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp.properties
+++ b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp.properties
@@ -1,24 +1,55 @@
-## The downstream OP if discovery is not used
-idp.authn.oidc.rp.proxyIssuer= <issuerId>
+##does not need the .well-known/openid-configuration path.
+#idp.oidc.rp.providerConfigurationDocument=https://www.certification.openid.net/test/a/test_rp_proxy/
+#idp.oidc.rp.redirectURI=https://localhost:8443/idp/profile/Authn/OIDC/RP/callback
+## openid is defaulted. Other scopes could be; profile etc.
+#idp.oidc.rp.scope=email
+#idp.authn.OIDC.RP.discoveryRequired=true
+## normally in authn.properties
+#idp.authn.discoveryURL=http://phil.com
+## find metadata from the well-known location
+#idp.authn.oidc.rp.proxyIssuer=https://www.certification.openid.net/test/a/test_rp_proxy/
+idp.authn.oidc.rp.proxyIssuer=https://accounts.google.com
+#idp.authn.oidc.rp.proxyIssuer=https://testop.funet.fi
+idp.authn.oidc.rp.client.redirecturl.allowedOrigins = https://localhost:8443
+## If discovery is required, these default properties will not be set, you must manage per OP using overrides
+idp.authn.oidc.rp.client.clientId = mytestclient
+#idp.authn.oidc.rp.client.clientSecret = !A%D*F-JaNdRgUkXp2s5v8y/B?E(H+Kb
+#idp.authn.oidc.rp.client.clientSecret=UjWnZr4u7x!A%D*G-KaPdSgVkYp2s5v8
+idp.authn.oidc.rp.client.clientSecret=
+#idp.authn.oidc.rp.client.clientSecretExpiresAt = PT0S
-idp.authn.oidc.rp.client.redirectURL= https://localhost/callback
+## Use small fetch interval so we can re-run tests against the certification OP
+idp.authn.oidc.rp.provider.keyfetch.interval = PT5S
-# If a redirect_uri is not explicitly declared above, one can be inferred from each
-# request's Host header. To avoid Host header injection attacks, the allowed origins
-# must be specified here. Origins are comma seperated. Do not specify the port when
-# using the default ports.
-idp.authn.oidc.rp.client.redirecturl.allowedOrigins = https://localhost
+## Uncomment this if you want to enable RSA decryption (where the public key is registered with the OP)
+idp.authn.oidc.rp.client.enc.key=%{idp.home}/credentials/idp-encryption-rsa.jwk
+idp.authn.oidc.rp.client.sig.key=%{idp.home}/credentials/idp-signing-rsa.jwk
+## Example key wrap key (oct)
+#idp.authn.oidc.rp.client.requestobject.enc.symmetric.kw.key=%{idp.home}/credentials/oidc-rp-requestobject-encryption.jwk
+#idp.authn.oidc.rp.client.requestobject.enc.symmetric.cek.key=%{idp.home}/credentials/...
+idp.authn.oidc.rp.discoveryRequired=false
+idp.authn.oidc.rp.client.requestobject.supported= false
+idp.authn.oidc.rp.client.requestobject.encrypted = false
+idp.authn.oidc.rp.client.requestobject.signed = true
-## openid is defaulted. Other scopes could be; profile etc.
-#idp.oidc.rp.scope=openid
+idp.authn.oidc.rp.useUserInfoEndpoint = true
+
+## Override the default response_mode for the given response_type
+idp.authn.oidc.rp.responseMode = form_post
+
+## Comma seperated list of additional scopes e.g. PROFILE or EMAIL. The openid scope is added by default
+idp.authn.oidc.rp.scopes = profile,email
+
+idp.authn.oidc.rp.supportedPrincipals = saml2/http://example.org/ac/classes/mfa
+
+## Inbuilt C14N options for converting a Subject Identifier into a principal name
+idp.authn.oidc.rp.c14n.subjectidentifier.lowercase = false
+idp.authn.oidc.rp.c14n.subjectidentifier.uppercase = false
+idp.authn.oidc.rp.c14n.subjectidentifier.trim = true
+idp.authn.oidc.rp.c14n.subjectidentifier.disabled = false
+
+#idp.authn.oidc.rp.clientAuthenticationMethod = client_secret_basic
-## A fixed client_id that can be used with the given proxy issuer.
-idp.authn.oidc.rp.client.clientId = client_id
-## A set of fixed client authentication parameters, which can be used when a single client is configured. If the secret
-## is set here, these settings will be enabled for client_authentication.
-idp.authn.oidc.rp.client.clientSecret = client_secret
-#idp.authn.oidc.rp.client.clientSecretExpiresAt = PT0S
-#idp.authn.oidc.rp.client.clientAuthenticationMethod = client_secret_basic
\ No newline at end of file
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java
index 857679b..a995aca 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java
@@ -22,7 +22,6 @@ import java.net.URI;
import java.net.UnknownHostException;
import java.security.Principal;
import java.util.ArrayList;
-import java.util.Collections;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
@@ -41,7 +40,6 @@ import org.opensaml.core.metrics.impl.MetricRegistryInitializer;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.security.credential.Credential;
-import org.opensaml.security.credential.CredentialResolver;
import org.opensaml.xmlsec.config.GlobalAlgorithmRegistryInitializer;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -56,7 +54,6 @@ import org.springframework.webflow.test.MockFlowBuilderContext;
import com.nimbusds.jose.JOSEException;
import com.nimbusds.jose.JWEAlgorithm;
import com.nimbusds.jose.jwk.RSAKey;
-import com.nimbusds.jwt.SignedJWT;
import com.nimbusds.oauth2.sdk.ParseException;
import com.nimbusds.oauth2.sdk.ResponseMode;
import com.nimbusds.oauth2.sdk.ResponseType;
@@ -91,9 +88,10 @@ import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
import net.shibboleth.oidc.security.credential.BasicJWKCredential;
import net.shibboleth.oidc.security.credential.JOSEObjectCredentialResolver;
import net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver;
+import net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver;
import net.shibboleth.oidc.security.credential.impl.CriterionCredentialResolver;
import net.shibboleth.oidc.security.impl.BasicJWTDecryptionConfiguration;
-import net.shibboleth.oidc.security.impl.BasicSignatureValidationConfiguration;
+import net.shibboleth.oidc.security.impl.BasicJWTSignatureValidationConfiguration;
import net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
@@ -416,26 +414,16 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
final var securityConfig = new OIDCSecurityConfiguration();
- final var idTokenSigValConfig = new BasicSignatureValidationConfiguration<SignedJWT>();
- idTokenSigValConfig.setSignatureTrustEngine(
+ final var sigValConfig = new BasicJWTSignatureValidationConfiguration();
+ sigValConfig.setSignatureTrustEngine(
new ExplicitKeySignedJWTTrustEngine(new CriterionCredentialResolver(),
new BasicJOSEObjectCredentialResolver()));
- securityConfig.setIdTokenJwtSignatureValidationConfiguration(idTokenSigValConfig);
-
- final var userInfoTokenSigValConfig = new BasicSignatureValidationConfiguration<SignedJWT>();
- userInfoTokenSigValConfig.setSignatureTrustEngine(
- new ExplicitKeySignedJWTTrustEngine(new CriterionCredentialResolver(),
- new BasicJOSEObjectCredentialResolver()));
- securityConfig.setUserInfoTokenJwtSignatureValidationConfiguration(userInfoTokenSigValConfig);
-
+ securityConfig.setJwtSignatureValidationConfiguration(sigValConfig);
+
//The CEK resolver just resolves keys from the criteria set.
- final var idTokenDecryptConfig = new BasicJWTDecryptionConfiguration();
- idTokenDecryptConfig.setContentEncryptionKeyCredentialResolver(new CriterionCredentialResolver());
- securityConfig.setIdTokenJwtDecryptionConfiguration(idTokenDecryptConfig);
-
- final var userInfoDecryptConfig = new BasicJWTDecryptionConfiguration();
- userInfoDecryptConfig.setContentEncryptionKeyCredentialResolver(new CriterionCredentialResolver());
- securityConfig.setUserInfoJwtDecryptionConfiguration(userInfoDecryptConfig);
+ final var tokenDecryptConfig = new BasicJWTDecryptionConfiguration();
+ tokenDecryptConfig.setContentEncryptionKeyCredentialResolver(new CriterionCredentialResolver());
+ securityConfig.setJwtDecryptionConfiguration(tokenDecryptConfig);
return securityConfig;
}
@@ -882,20 +870,12 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
// Set a default security config for the profile config
final OIDCSecurityConfiguration secConfig = new OIDCSecurityConfiguration();
- //Signature config for id_token
- final BasicSignatureValidationConfiguration<SignedJWT> sigValidation =
- new BasicSignatureValidationConfiguration<>();
- sigValidation.setSignatureTrustEngine(new ExplicitKeySignedJWTTrustEngine(
- new CriterionCredentialResolver(), new BasicJOSEObjectCredentialResolver()));
-
- secConfig.setIdTokenJwtSignatureValidationConfiguration(sigValidation);
-
final var idTokenDecryptConfig = new BasicJWTDecryptionConfiguration();
idTokenDecryptConfig.setContentEncryptionKeyCredentialResolver(new CriterionCredentialResolver());
- final var userInfoDecryptConfig = new BasicJWTDecryptionConfiguration();
- userInfoDecryptConfig.setContentEncryptionKeyCredentialResolver(new CriterionCredentialResolver());
- userInfoDecryptConfig.setKEKCredentialResolver(new JOSEObjectCredentialResolver() {
+ final var decryptConfig = new BasicJWTDecryptionConfiguration();
+ decryptConfig.setContentEncryptionKeyCredentialResolver(new CriterionCredentialResolver());
+ decryptConfig.setKEKCredentialResolver(new JOSEObjectCredentialResolver() {
@Override
public Credential resolveSingle(final CriteriaSet criteria) throws ResolverException {
@@ -915,14 +895,15 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
return List.of(resolveSingle(criteria));
}
});
- secConfig.setIdTokenJwtDecryptionConfiguration(idTokenDecryptConfig);
- secConfig.setUserInfoJwtDecryptionConfiguration(userInfoDecryptConfig);
+ secConfig.setJwtDecryptionConfiguration(decryptConfig);
//Signature config for userinfo token
- final BasicSignatureValidationConfiguration<SignedJWT> sigValidationUserInfo =
- new BasicSignatureValidationConfiguration<>();
- sigValidationUserInfo.setSignatureTrustEngine(new ExplicitKeySignedJWTTrustEngine(
- new CredentialResolver() {
+ final BasicJWTSignatureValidationConfiguration sigValidation =
+ new BasicJWTSignatureValidationConfiguration();
+ sigValidation.setSignatureTrustEngine(
+ new ExplicitKeySignedJWTTrustEngine(
+ new ChainingJOSEObjectCredentialResolver(List.of(new CriterionCredentialResolver(),
+ new JOSEObjectCredentialResolver() {
@Override
public Credential resolveSingle(final CriteriaSet criteria) throws ResolverException {
@@ -941,9 +922,9 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
public Iterable<Credential> resolve(final CriteriaSet criteria) throws ResolverException {
return List.of(resolveSingle(criteria));
}
- }, new BasicJOSEObjectCredentialResolver()));
+ })), new BasicJOSEObjectCredentialResolver()));
- secConfig.setUserInfoTokenJwtSignatureValidationConfiguration(sigValidationUserInfo);
+ secConfig.setJwtSignatureValidationConfiguration(sigValidation);
partyConfig.setSecurityConfiguration(secConfig);
@@ -1007,15 +988,16 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
.getProfileConfig();
final OIDCSecurityConfiguration secConfig = new OIDCSecurityConfiguration();
- final BasicSignatureValidationConfiguration<SignedJWT> sigValidation =
- new BasicSignatureValidationConfiguration<>();
+
+ final BasicJWTSignatureValidationConfiguration sigValidation =
+ new BasicJWTSignatureValidationConfiguration();
sigValidation.setSignatureTrustEngine(new ExplicitKeySignedJWTTrustEngine(
new CriterionCredentialResolver(), new BasicJOSEObjectCredentialResolver()));
- secConfig.setIdTokenJwtSignatureValidationConfiguration(sigValidation);
+ secConfig.setJwtSignatureValidationConfiguration(sigValidation);
- final var idTokenDecryptConfig = new BasicJWTDecryptionConfiguration();
- idTokenDecryptConfig.setKEKCredentialResolver(new JOSEObjectCredentialResolver() {
+ final var decryptConfig = new BasicJWTDecryptionConfiguration();
+ decryptConfig.setKEKCredentialResolver(new JOSEObjectCredentialResolver() {
@Override
public Credential resolveSingle(final CriteriaSet criteria) throws ResolverException {
@@ -1036,7 +1018,7 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
}
});
- secConfig.setIdTokenJwtDecryptionConfiguration(idTokenDecryptConfig);
+ secConfig.setJwtDecryptionConfiguration(decryptConfig);
partyConfig.setSecurityConfiguration(secConfig);
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/RelyingPartyProxySigningParametersResolverTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/RelyingPartyProxySigningParametersResolverTest.java
index 438d10b..995df61 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/RelyingPartyProxySigningParametersResolverTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/RelyingPartyProxySigningParametersResolverTest.java
@@ -35,8 +35,6 @@ import javax.crypto.spec.SecretKeySpec;
import org.opensaml.core.config.InitializationException;
import org.opensaml.security.credential.UsageType;
import org.opensaml.xmlsec.config.GlobalAlgorithmRegistryInitializer;
-import org.opensaml.xmlsec.criterion.SignatureSigningConfigurationCriterion;
-import org.opensaml.xmlsec.impl.BasicSignatureSigningConfiguration;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
@@ -59,8 +57,10 @@ import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
import net.shibboleth.oidc.security.JWTSignatureSigningParameters;
import net.shibboleth.oidc.security.credential.BasicExpiringJWKCredential;
import net.shibboleth.oidc.security.credential.JWKCredential;
+import net.shibboleth.oidc.security.criterion.JWTSignatureSigningConfigurationCriterion;
import net.shibboleth.oidc.security.criterion.ProviderMetadataCriterion;
import net.shibboleth.oidc.security.criterion.StaticCredentialCriterion;
+import net.shibboleth.oidc.security.impl.BasicJWTSignatureSigningConfiguration;
import net.shibboleth.oidc.security.impl.JWSAssemblyUtils;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
import net.shibboleth.utilities.java.support.resolver.ResolverException;
@@ -177,9 +177,9 @@ public class RelyingPartyProxySigningParametersResolverTest extends AbstractOIDC
criteria.add(new StaticCredentialCriterion(createClientSecretCredential("atestsecret")));
// Add an RSA type to the security config
- final BasicSignatureSigningConfiguration config =
- (BasicSignatureSigningConfiguration)
- criteria.get(SignatureSigningConfigurationCriterion.class).getConfigurations().get(0);
+ final BasicJWTSignatureSigningConfiguration config =
+ (BasicJWTSignatureSigningConfiguration)
+ criteria.get(JWTSignatureSigningConfigurationCriterion.class).getConfigurations().get(0);
config.setSigningCredentials(List.of(createRSASigningCredential(new RSAKeyGenerator(2048)
.keyID("1")
@@ -199,7 +199,8 @@ public class RelyingPartyProxySigningParametersResolverTest extends AbstractOIDC
assertNotNull(params.iterator().next().getSigningCredential().getPrivateKey());
assertTrue(params.iterator().next().getSigningCredential().getPrivateKey() instanceof RSAPrivateKey);
}
-
+
+ /* Also should preserve alg order from the config.*/
@Test
public void testResolveSuccess_ECCredentials_OPSupportsTwo() throws Exception {
final CriteriaSet criteria = buildCriteria(List.of(SignatureConstants.ALGO_ID_SIGNATURE_RS_256,
@@ -209,9 +210,9 @@ public class RelyingPartyProxySigningParametersResolverTest extends AbstractOIDC
criteria.add(new StaticCredentialCriterion(createClientSecretCredential("atestsecret")));
// Add an RSA type to the security config
- final BasicSignatureSigningConfiguration config =
- (BasicSignatureSigningConfiguration)
- criteria.get(SignatureSigningConfigurationCriterion.class).getConfigurations().get(0);
+ final BasicJWTSignatureSigningConfiguration config =
+ (BasicJWTSignatureSigningConfiguration)
+ criteria.get(JWTSignatureSigningConfigurationCriterion.class).getConfigurations().get(0);
config.setSigningCredentials(List.of(createRSASigningCredential(
new ECKeyGenerator(Curve.P_256).keyID("123").generate())));
@@ -219,7 +220,7 @@ public class RelyingPartyProxySigningParametersResolverTest extends AbstractOIDC
// Now let the OP support one of those which matches one of the credentials
final OIDCProviderMetadata metadata =
new OIDCProviderMetadata(new Issuer("test"), List.of(SubjectType.PUBLIC), new URI("nowhere"));
- metadata.setRequestObjectJWSAlgs(List.of(JWSAlgorithm.RS256, JWSAlgorithm.ES256));
+ metadata.setRequestObjectJWSAlgs(List.of(JWSAlgorithm.ES256, JWSAlgorithm.RS256));
criteria.add(new ProviderMetadataCriterion(metadata));
final Iterable<JWTSignatureSigningParameters> params = resolver.resolve(criteria);
@@ -233,9 +234,9 @@ public class RelyingPartyProxySigningParametersResolverTest extends AbstractOIDC
private CriteriaSet buildCriteria(final List<String> supportedSigningAlgos) {
final CriteriaSet crit = new CriteriaSet();
- final BasicSignatureSigningConfiguration config = new BasicSignatureSigningConfiguration();
+ final BasicJWTSignatureSigningConfiguration config = new BasicJWTSignatureSigningConfiguration();
config.setSignatureAlgorithms(supportedSigningAlgos);
- crit.add(new SignatureSigningConfigurationCriterion(List.of(config)));
+ crit.add(new JWTSignatureSigningConfigurationCriterion(List.of(config)));
return crit;
}
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/TestTokenHelper.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/TestTokenHelper.java
index 0ae02a7..5607d1f 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/TestTokenHelper.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/TestTokenHelper.java
@@ -18,7 +18,6 @@
package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
-import java.nio.charset.StandardCharsets;
import java.time.Instant;
import java.util.Date;
import java.util.List;
@@ -48,6 +47,8 @@ import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.jwt.PlainJWT;
import com.nimbusds.jwt.SignedJWT;
+import net.shibboleth.oidc.security.credential.JWKCredential;
+import net.shibboleth.oidc.security.impl.JWKCredentialSupport;
import net.shibboleth.utilities.java.support.collection.Pair;
/** A helper class for generating tokens for testing.*/
@@ -141,6 +142,11 @@ public final class TestTokenHelper {
.type(JOSEObjectType.JWT)
.build();
+ //client_secret needs to be derived
+ final JWKCredential derviedCred = JWKCredentialSupport.deriveSymmetricKeyForAlgAndEnc(
+ TestCredentialHelper.createClientSecretCredential(clientSecret), JWEAlgorithm.DIR,
+ EncryptionMethod.A256GCM);
+
final var payload = createBasicClaims("jdoe", "abadnonce", "jdoe", opIssuerId, clientId, audience);
final var signedJWT = new SignedJWT(header,payload);
signedJWT.sign(new MACSigner(clientSecret));
@@ -150,7 +156,7 @@ public final class TestTokenHelper {
.contentType("JWT")
.build(),
new Payload(signedJWT));
- jweObject.encrypt(new DirectEncrypter(clientSecret.getBytes(StandardCharsets.UTF_8)));
+ jweObject.encrypt(new DirectEncrypter(derviedCred.getSecretKey()));
final EncryptedJWT jwe = EncryptedJWT.parse(jweObject.serialize());
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list