[java-idp-oidc] 02/02: JOIDC-142 - Improve Request Object handling and configuration

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=94d9bd86e4447eab1395ae8ad8c1cb7029cdfa92

commit 94d9bd86e4447eab1395ae8ad8c1cb7029cdfa92
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Tue Apr 25 15:03:27 2023 +0300

    JOIDC-142 - Improve Request Object handling and configuration
    
    https://shibboleth.atlassian.net/browse/JOIDC-142
    
    Changed 'encryptRequestObject' setting to enforce request object encryption
    only when 'useRequestObject' is set to 'true'. Previously the encryption-flag
    was silently also enforcing the use of request objects.
    
    Now the logic is the same as with 'signRequestObject': the sign/encrypt -specific
    flag is enforcing the feature if request object is used. To enforce the use of
    request objects, one must use the 'useRequestObject' setting.
---
 .../shibboleth/idp/flows/oidc/authorize/authorize-beans.xml    | 10 +++++++++-
 .../src/test/resources/conf/relying-party.xml                  |  2 +-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
index ddc50316..35592408 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
@@ -134,7 +134,15 @@
         <property name="encryptionOptionalPredicate">
             <bean parent="shibboleth.Conditions.NOT">
                 <constructor-arg>
-                    <bean class="net.shibboleth.oidc.profile.config.logic.EncryptRequestObjectPredicate"/>
+                    <bean parent="shibboleth.Conditions.AND">
+                        <constructor-arg>
+                            <bean parent="shibboleth.Conditions.Expression"
+                                c:expression="#input.getOutboundMessageContext().getSubcontext(T(net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext)).getRequestObject() != null" />
+                        </constructor-arg>
+                        <constructor-arg>
+                            <bean class="net.shibboleth.oidc.profile.config.logic.EncryptRequestObjectPredicate"/>
+                        </constructor-arg>
+                    </bean>
                 </constructor-arg>
             </bean>
         </property>
diff --git a/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml b/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml
index 399d41e9..97170199 100644
--- a/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml
+++ b/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml
@@ -92,7 +92,7 @@
         <bean parent="RelyingPartyByName" c:relyingPartyIds="mockClientIdRequestObjectEncryptionEnforced">
             <property name="profileConfigurations">
                  <list>
-                     <bean parent="OIDC.SSO.MDDriven" p:encryptionOptional="false" p:encryptRequestObject="true"/>
+                     <bean parent="OIDC.SSO.MDDriven" p:encryptionOptional="false" p:useRequestObject="true" p:encryptRequestObject="true" p:signRequestObject="false"/>
                      <bean parent="OAUTH2.Token.MDDriven" p:encryptionOptional="false" />
                      <bean parent="OIDC.UserInfo.MDDriven" p:encryptionOptional="false" />
                  </list>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.