[java-idp-oidc] branch main updated: JOIDC-149 - Configurability of ID Token issuance via Refresh Tokens

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=65f990b694071901f0df16d1b2b241715e0cf1c4

The following commit(s) were added to refs/heads/main by this push:
     new 65f990b6 JOIDC-149 - Configurability of ID Token issuance via Refresh Tokens
65f990b6 is described below

commit 65f990b694071901f0df16d1b2b241715e0cf1c4
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Apr 21 13:05:38 2023 +0300

    JOIDC-149 - Configurability of ID Token issuance via Refresh Tokens
    
    https://shibboleth.atlassian.net/browse/JOIDC-149
    
    Changed the property flag to idp.oidc.issueIdTokenViaRefreshToken as it’s related to OIDC and not OAuth2.
---
 .../META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml  | 4 ++--
 .../resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties  | 3 +++
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index 117433d0..02b2f5e4 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -44,7 +44,7 @@
         class="net.shibboleth.oidc.profile.oauth2.config.impl.DefaultOAuth2TokenConfiguration"
         p:grantTypes="%{idp.oauth2.grantTypes:authorization_code,refresh_token}"
         p:enforceRefreshTokenRotation="%{idp.oauth2.enforceRefreshTokenRotation:false}"
-        p:issueIdTokenViaRefreshToken="%{idp.oauth2.issueIdTokenViaRefreshToken:true}" />
+        p:issueIdTokenViaRefreshToken="%{idp.oidc.issueIdTokenViaRefreshToken:true}" />
     
     <bean id="OAUTH2.TokenAudience" parent="AbstractOIDCProfile" lazy-init="true"
         class="net.shibboleth.oidc.profile.oauth2.config.impl.DefaultOAuth2TokenAudienceConfiguration"
@@ -409,7 +409,7 @@
                 <constructor-arg>
                     <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="issueIdTokenViaRefreshToken" />
                 </constructor-arg>
-                <constructor-arg value="%{idp.oauth2.issueIdTokenViaRefreshToken:true}" />
+                <constructor-arg value="%{idp.oidc.issueIdTokenViaRefreshToken:true}" />
             </bean>
         </property>
     </bean>
diff --git a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
index aae37f31..dde2b56f 100644
--- a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
+++ b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
@@ -154,6 +154,9 @@ idp.oidc.subject.salt = this_too_should_be_ch4ng3d
 # Set true to enforce refresh token rotation (defaults to false)
 #idp.oauth2.enforceRefreshTokenRotation = true
 
+# Set to false to disable id_token issuance via refresh_tokens (defaults to true)
+#idp.oidc.issueIdTokenViaRefreshToken = false
+
 # Revocation method: set to TOKEN to revoke single tokens (defaults to full chain (value = CHAIN))
 #idp.oauth2.revocationMethod = TOKEN
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.