[java-idp-plugin-oidc-rp] branch main updated: Cleanup bean IDs
Phil Smart
philip.smart at jisc.ac.uk
Tue Apr 25 14:16:26 UTC 2023
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=ce9f1f7bcb20a3bb898f7f7e8bcd233938fae492
The following commit(s) were added to refs/heads/main by this push:
new ce9f1f7 Cleanup bean IDs
ce9f1f7 is described below
commit ce9f1f7bcb20a3bb898f7f7e8bcd233938fae492
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Tue Apr 25 15:16:24 2023 +0100
Cleanup bean IDs
- Remove prefix from beans only local to the flow
---
.../oidc-relying-party-authn-beans.xml | 108 +++++++++------------
.../oidc-relying-party-authn-flow.xml | 1 -
2 files changed, 45 insertions(+), 64 deletions(-)
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
index 046f061..998bd7e 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
@@ -46,7 +46,6 @@
<bean id="FlowStartPopulateAuditContext" parent="shibboleth.AbstractPopulateAuditContext"
p:fieldExtractors="#{getObject('shibboleth.FlowStartAuditExtractors') ?: getObject('shibboleth.DefaultFlowStartAuditExtractors')}" />
-
<bean id="PrepareOIDCInboundMessageContext"
class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.PrepareOIDCInboundMessageContext" scope="prototype"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext">
@@ -79,7 +78,6 @@
class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.InitializeRelyingPartyContext" scope="prototype"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext" />
-
<bean id="InitializeOutboundMessageContext"
class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.InitializeOutboundAuthorizationRequestMessageContext"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext" scope="prototype" />
@@ -88,7 +86,6 @@
class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.InitializeOAuth2ClientContext"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext" />
-
<bean id="SelectRelyingPartyConfiguration"
class="net.shibboleth.idp.profile.impl.SelectRelyingPartyConfiguration" scope="prototype"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
@@ -101,7 +98,6 @@
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
p:fieldExtractors="#{getObject('shibboleth.authn.oidc.rp.PostLookupAuditExtractors') ?: getObject('shibboleth.authn.oidc.rp.DefaultPostLookupAuditExtractors')}" />
-
<bean id="InitializeAuthorizationRequest"
class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.InitializeAuthorizationRequest" scope="prototype"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext" />
@@ -132,7 +128,7 @@
class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.AddRedirectURIHandler"
p:httpServletRequest-ref="shibboleth.authn.oidc.rp.internal.HttpServletRequest"
p:redirectUriCreationStrategy="#{getObject('shibboleth.authn.oidc.rp.RedirectUriCreationStrategy') ?:
- getObject('shibboleth.authn.oidc.rp.DefaultRedirectUriCreationStrategy')}" />
+ getObject('DefaultRedirectUriCreationStrategy')}" />
<bean id="AddAuthenticationContextClassReferences" scope="prototype"
class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.AddAuthenticationContextClassReferencesHandler"/>
<bean id="AddForceAuthentication" scope="prototype"
@@ -160,7 +156,7 @@
<bean id="RequestObjectRequiredAndSupportedPredicate"
class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic.RequestObjectRequiredAndSupported" />
- <bean id="shibboleth.authn.oidc.rp.SignRequestObjectProxyCondition"
+ <bean id="SignRequestObjectProxyCondition"
class="net.shibboleth.oidc.profile.config.logic.SignRequestObjectPredicate"
p:relyingPartyContextLookupStrategy-ref="shibboleth.ChildLookup.Proxy.RelyingPartyContext" />
@@ -173,14 +169,14 @@
c:strategy-ref="shibboleth.ChildLookup.Proxy.MessageContextLookup.Inbound" p:noResultIsError="true"
p:configurationLookupStrategy-ref="RequestObjectSignatureSigningConfigurationLookup"
p:providerMetadataContextLookupStrategy-ref="shibboleth.ChildLookup.OIDCProviderMetadataContextFromOutbound"
- p:signatureSigningParametersResolver-ref="shibboleth.authn.oidc.rp.RequestObjectSignatureSigningParametersResolver"
- p:activationCondition-ref="shibboleth.authn.oidc.rp.SignRequestObjectProxyCondition" />
+ p:signatureSigningParametersResolver-ref="RequestObjectSignatureSigningParametersResolver"
+ p:activationCondition-ref="SignRequestObjectProxyCondition" />
- <bean id="shibboleth.authn.oidc.rp.RequestObjectSignatureSigningParametersResolver"
+ <bean id="RequestObjectSignatureSigningParametersResolver"
class="net.shibboleth.idp.plugin.authn.oidc.rp.security.impl.RelyingPartyProxySigningParametersResolver"
- p:providerMetadataAlgorithmLookupStrategy-ref="shibboleth.authn.oidc.rp.RequestObjectSupportedSignatureSigningAlgorithms" />
+ p:providerMetadataAlgorithmLookupStrategy-ref="RequestObjectSupportedSignatureSigningAlgorithms" />
- <bean id="shibboleth.authn.oidc.rp.RequestObjectSupportedSignatureSigningAlgorithms" scope="prototype"
+ <bean id="RequestObjectSupportedSignatureSigningAlgorithms" scope="prototype"
class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.navigate.RequestObjectSupportedSignatureSigningAlgorithms" />
<bean id="RequestObjectSignatureSigningConfigurationLookup" lazy-init="true"
@@ -195,15 +191,14 @@
p:configurationLookupStrategy-ref="RequestObjectEncryptionConfigurationLookup"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
p:providerMetadataContextLookupStrategy-ref="shibboleth.ChildLookup.OIDCProviderMetadataContextFromOutbound"
- p:encryptionParametersResolver-ref="shibboleth.authn.oidc.rp.EncryptionParametersResolver"
+ p:encryptionParametersResolver-ref="EncryptionParametersResolver"
p:activationCondition-ref="EncryptRequestObjectCondition" />
<bean id="RequestObjectEncryptionConfigurationLookup" lazy-init="true"
class="net.shibboleth.oidc.profile.config.navigate.JWTEncryptionConfigurationLookupFunction"
p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
- <!-- TODO Should the resolvers move to the post-config as they are global singletons -->
- <bean id="shibboleth.authn.oidc.rp.EncryptionParametersResolver"
+ <bean id="EncryptionParametersResolver"
class="net.shibboleth.oidc.security.jose.impl.DefaultEncryptionParametersResolver">
<property name="keyTransportEncryptionAlgorithmsLookupStrategy">
<bean
@@ -226,18 +221,16 @@
</property>
</bean>
-
<bean id="BuildRequestObject" class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.BuildRequestObject"
scope="prototype" p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
p:authenticationContextLookupStrategy-ref="ParentAuthenticiationContextLookup"
p:claimsSetIsValidPredicate="#{getObject('shibboleth.authn.oidc.rp.RequestObjectClaimsSetIsValidPredicate')}"
- p:requestObjectToBeSignedPredicate-ref="shibboleth.authn.oidc.rp.SignRequestObjectCondition" />
+ p:requestObjectToBeSignedPredicate-ref="SignRequestObjectCondition" />
- <bean id="shibboleth.authn.oidc.rp.SignRequestObjectCondition"
+ <bean id="SignRequestObjectCondition"
class="net.shibboleth.oidc.profile.config.logic.SignRequestObjectPredicate"
p:relyingPartyContextLookupStrategy-ref="shibboleth.ChildLookup.RelyingParty" />
-
<!-- Message Encoder factory is a prototype to allow reuse of the encoders -->
<bean id="messageEncoderFactory"
class="net.shibboleth.oidc.profile.impl.AuthenticationRequestMessageEncoderFactory" scope="prototype"
@@ -259,7 +252,6 @@
p:velocityEngine-ref="shibboleth.VelocityEngine" p:httpServletResponse-ref="shibboleth.authn.oidc.rp.internal.HttpServletResponse"
p:authorizationParamsAreValidPredicate="#{getObject('shibboleth.authn.oidc.rp.AuthzParamsValidPredicate')}" />
-
<bean id="EncodeMessage" class="org.opensaml.profile.action.impl.EncodeMessage" scope="prototype"
p:messageEncoderFactory-ref="messageEncoderFactory" p:httpServletResponse-ref="shibboleth.authn.oidc.rp.internal.HttpServletResponse" />
@@ -305,7 +297,7 @@
</property>
</bean>
- <bean id="shibboleth.authn.oidc.rp.DefaultRedirectUriCreationStrategy"
+ <bean id="DefaultRedirectUriCreationStrategy"
p:callbackServletPath="#{getObject('shibboleth.authn.OIDC.externalServletPath')}/callback"
p:allowedOrigins="%{idp.authn.oidc.rp.client.redirecturl.allowedOrigins:}"
class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.DefaultRedirectUriCreationFunction" />
@@ -328,7 +320,6 @@
class="net.shibboleth.oidc.profile.decoding.impl.HTTPPostAuthnResponseDecoder" init-method="" scope="prototype"
p:httpServletRequest-ref="shibboleth.authn.oidc.rp.internal.HttpServletRequest" />
-
<!-- After authentication response -->
<bean id="ValidateExternalAuthenticationContext" scope="prototype"
class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.ValidateExternalAuthenticationContext" />
@@ -362,7 +353,6 @@
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
p:fieldExtractors="#{getObject('shibboleth.authn.oidc.rp.AuthenticationResponseAuditExtractors') ?: getObject('shibboleth.authn.oidc.rp.DefaultAuthenticationResponseAuditExtractors')}" />
-
<bean id="IsCodeFlow" class=" net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic.IsCodeFlowPredicate" />
<bean id="IsHybridFlow" class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic.IsHybridFlowPredicate" />
<bean id="IsImplicitFlow" class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic.IsImplicitFlowPredicate" />
@@ -379,24 +369,22 @@
p:authenticationContextLookupStrategy-ref="ParentAuthenticiationContextLookup"
p:httpClient="#{getObject('shibboleth.authn.oidc.rp.HttpClient') ?: getObject('shibboleth.InternalHttpClient')}"
p:httpClientSecurityParameters="#{getObject('shibboleth.authn.oidc.rp.HttpClientSecurityParameters')}"
- p:httpResponseDecoderStrategy="#{getObject('shibboleth.authn.oidc.rp.TokenResponseDecoder') ?: getObject('shibboleth.authn.oidc.rp.DefaultTokenResponseDecoder')}"
- p:httpRequestEncoderStrategy="#{getObject('shibboleth.authn.oidc.rp.TokenRequestEncoder') ?: getObject('shibboleth.authn.oidc.rp.DefaultAuthCodeTokenResponseEncoder')}" />
+ p:httpResponseDecoderStrategy="#{getObject('shibboleth.authn.oidc.rp.TokenResponseDecoder') ?: getObject('DefaultTokenResponseDecoder')}"
+ p:httpRequestEncoderStrategy="#{getObject('shibboleth.authn.oidc.rp.TokenRequestEncoder') ?: getObject('DefaultAuthCodeTokenResponseEncoder')}" />
<bean id="ValidateOAuthAccessTokenResponse" scope="prototype"
class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.ValidateOAuthAccessTokenResponse"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
p:authenticationContextLookupStrategy-ref="ParentAuthenticiationContextLookup" />
- <bean id="shibboleth.authn.oidc.rp.DefaultTokenResponseDecoder" scope="prototype"
+ <bean id="DefaultTokenResponseDecoder" scope="prototype"
class="net.shibboleth.idp.plugin.authn.oidc.rp.decoding.impl.DefaultAccessTokenResponseDecoder"
p:objectMapper="#{getObject('shibboleth.authn.oidc.rp.JSONObjectMapper') ?: getObject('shibboleth.authn.oidc.rp.DefaultJSONObjectMapper')}" />
- <bean id="shibboleth.authn.oidc.rp.DefaultAuthCodeTokenResponseEncoder" scope="prototype"
+ <bean id="DefaultAuthCodeTokenResponseEncoder" scope="prototype"
class="net.shibboleth.idp.plugin.authn.oidc.rp.encoding.impl.DefaultAuthCodeTokenRequestEncoder" />
-
<!-- ID TOKEN Decryption (TODO: should this be a message handler chain for consistency) -->
-
<bean id="PopulateIDTokenDecryptionParameters"
class="net.shibboleth.oidc.profile.impl.PopulateJWTDecryptionParameters" scope="prototype"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
@@ -421,7 +409,6 @@
</bean>
<!-- ID TOKEN Signature Validation -->
-
<bean id="IDTokenSignatureValidation" parent="NestedWebFlowMessageHandlerAdaptor" scope="prototype"
c:executionDirection="INBOUND">
<constructor-arg>
@@ -476,7 +463,6 @@
</property>
</bean>
-
<bean id="ValidateIDTokenClaims" scope="prototype"
class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.ValidateTokenClaims"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
@@ -484,11 +470,11 @@
p:cleanupHook="#{getObject('shibboleth.authn.oidc.rp.idtoken.jwt.claims.CleanUpHook')
?: getObject('DefaultCleanupHook')}"
p:claimsValidator="#{getObject('shibboleth.authn.oidc.rp.idtoken.IDTokenClaimsValidator')
- ?: getObject('shibboleth.authn.oidc.rp.idtoken.DefaultIDTokenClaimsValidator')}"
+ ?: getObject('DefaultIDTokenClaimsValidator')}"
p:jwtLookupStrategy="#{getObject('shibboleth.authn.oidc.rp.idtoken.IDTokenLookupStrategy')
?: getObject('shibboleth.authn.oidc.rp.DefaultIDTokenLookupStrategy')}" />
- <bean id="shibboleth.authn.oidc.rp.idtoken.DefaultIDTokenClaimsValidator"
+ <bean id="DefaultIDTokenClaimsValidator"
class="net.shibboleth.oidc.security.jwt.claims.impl.ChainingJWTClaimsValidator"
p:claimValidators-ref="IDTokenClaimsValidators" />
@@ -583,14 +569,14 @@
<bean id="NonceClaimValidator" class="net.shibboleth.oidc.security.jwt.claims.impl.ExactMatchClaimsValidator"
p:claimName="nonce"
p:valueToMatchLookupStrategy="#{getObject('shibboleth.authn.oidc.rp.jwt.NonceLookupStrategy') ?:
- getObject('shibboleth.authn.oidc.rp.jwt.DefaultNonceLookupStrategy')}"
+ getObject('DefaultNonceLookupStrategy')}"
p:activationCondition="#{getObject('shibboleth.authn.oidc.rp.jwt.NonceActivationCondition') ?:
- getObject('shibboleth.authn.oidc.rp.jwt.DefaultNonceActivationCondition')}" />
+ getObject('DefaultNonceActivationCondition')}" />
- <bean id="shibboleth.authn.oidc.rp.jwt.DefaultNonceActivationCondition"
+ <bean id="DefaultNonceActivationCondition"
class="net.shibboleth.idp.plugin.authn.oidc.rp.security.impl.NonceValidationActivationCondition" />
- <bean id="shibboleth.authn.oidc.rp.jwt.DefaultNonceLookupStrategy"
+ <bean id="DefaultNonceLookupStrategy"
class="net.shibboleth.idp.plugin.authn.oidc.rp.security.impl.AuthenticationRequestNonceClaimLookupStrategy" />
<bean id="OIDCMetadataContextChildLookup" class="org.opensaml.messaging.context.navigate.ChildContextLookup"
@@ -602,14 +588,14 @@
<bean id="AtHashValidator" class="net.shibboleth.oidc.security.jwt.claims.impl.AccessTokenHashValidator"
p:allowMissing="%{idp.authn.oidc.rp.client.tokenresponse.allowMissingAtHash:true}"
p:accessTokenLookupStrategy="#{getObject('shibboleth.authn.oidc.rp.jwt.AccessTokenLookupStrategy') ?:
- getObject('shibboleth.authn.oidc.rp.jwt.DefaultAccessTokenLookupStrategy')}"
+ getObject('DefaultAccessTokenLookupStrategy')}"
p:joseHeaderLookupStrategy="#{getObject('shibboleth.authn.oidc.rp.jwt.IDTokenJOSEHeaderLookupStrategy') ?:
- getObject('shibboleth.authn.oidc.rp.jwt.DefaultIDTokenJOSEHeaderLookupStrategy')}"/>
+ getObject('DefaultIDTokenJOSEHeaderLookupStrategy')}"/>
- <bean id="shibboleth.authn.oidc.rp.jwt.DefaultAccessTokenLookupStrategy"
+ <bean id="DefaultAccessTokenLookupStrategy"
class="net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate.AccessTokenLookupStrategy"/>
- <bean id="shibboleth.authn.oidc.rp.jwt.DefaultIDTokenJOSEHeaderLookupStrategy"
+ <bean id="DefaultIDTokenJOSEHeaderLookupStrategy"
class="net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate.IDTokenJOSEHeaderLookupStrategy"/>
<bean id="AuthenticationTimeClaimValidator"
@@ -618,7 +604,7 @@
p:authnRequestTimeLookupStrategy-ref="AuthenticationRequestTimeLookupFunction"
p:clockSkew="%{idp.authn.oidc.rp.client.idtoken.jwt.verifier.clockSkew:PT60S}"
p:activationCondition="#{getObject('shibboleth.authn.oidc.rp.jwt.AuthTimeActivationCondition') ?:
- getObject('shibboleth.authn.oidc.rp.jwt.DefaultAuthTimeActivationCondition')}"/>
+ getObject('DefaultAuthTimeActivationCondition')}"/>
<bean id="MaxAgeLookupFunction"
class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.MaxAgeLookupFunction"
@@ -627,20 +613,19 @@
<bean id="AuthenticationRequestTimeLookupFunction"
class="net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate.AuthenticationRequestTimeLookupFunction"/>
- <bean id="shibboleth.authn.oidc.rp.jwt.DefaultAuthTimeActivationCondition"
+ <bean id="DefaultAuthTimeActivationCondition"
class="net.shibboleth.oidc.security.jwt.claims.impl.AuthTimeRequestedActivationCondition"
c:authenticationRequestLookupStrategy-ref="shibboleth.ChildLookup.MessageLookup.Outbound.OIDCAuthenticationRequest"/>
<bean id="ACRClaimValidator" class="net.shibboleth.oidc.security.jwt.claims.impl.ACRClaimsValidator"
p:requestedEssentialAcrsClaimLookupStrategy="#{getObject('shibboleth.authn.oidc.rp.jwt.RequestedEssentialAcrsClaimLookupStrategy') ?:
- getObject('shibboleth.authn.oidc.rp.jwt.DefaultRequestedEssentialAcrsClaimLookupStrategy')}"/>
+ getObject('DefaultRequestedEssentialAcrsClaimLookupStrategy')}"/>
- <bean id="shibboleth.authn.oidc.rp.jwt.DefaultRequestedEssentialAcrsClaimLookupStrategy"
+ <bean id="DefaultRequestedEssentialAcrsClaimLookupStrategy"
class="net.shibboleth.oidc.security.jwt.claims.impl.RequestedEssentialACRClaimsLookupStrategy"
c:authenticationRequestLookupStrategy-ref="shibboleth.ChildLookup.MessageLookup.Outbound.OIDCAuthenticationRequest"/>
- <!-- UserInfo Endpoint Beans -->
-
+ <!-- UserInfo Endpoint Beans -->
<bean id="CheckUserInfoRequiredCondition"
class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic.UserInfoLookupCondition" />
@@ -654,14 +639,14 @@
p:authenticationContextLookupStrategy-ref="ParentAuthenticiationContextLookup"
p:httpClient="#{getObject('shibboleth.authn.oidc.rp.HttpClient') ?: getObject('shibboleth.InternalHttpClient')}"
p:httpClientSecurityParameters="#{getObject('shibboleth.authn.oidc.rp.HttpClientSecurityParameters')}"
- p:httpResponseDecoderStrategy="#{getObject('shibboleth.authn.oidc.rp.UserInfoResponseDecoder') ?: getObject('shibboleth.authn.oidc.rp.DefaultUserInfoResponseDecoder')}"
- p:httpRequestEncoderStrategy="#{getObject('shibboleth.authn.oidc.rp.UserInfoRequestEncoder') ?: getObject('shibboleth.authn.oidc.rp.DefaultUserInfoRequestEncoder')}" />
+ p:httpResponseDecoderStrategy="#{getObject('shibboleth.authn.oidc.rp.UserInfoResponseDecoder') ?: getObject('DefaultUserInfoResponseDecoder')}"
+ p:httpRequestEncoderStrategy="#{getObject('shibboleth.authn.oidc.rp.UserInfoRequestEncoder') ?: getObject('DefaultUserInfoRequestEncoder')}" />
- <bean id="shibboleth.authn.oidc.rp.DefaultUserInfoResponseDecoder" scope="prototype"
+ <bean id="DefaultUserInfoResponseDecoder" scope="prototype"
class="net.shibboleth.idp.plugin.authn.oidc.rp.decoding.impl.DefaultUserInfoResponseDecoder"
p:objectMapper="#{getObject('shibboleth.authn.oidc.rp.JSONObjectMapper') ?: getObject('shibboleth.authn.oidc.rp.DefaultJSONObjectMapper')}"/>
- <bean id="shibboleth.authn.oidc.rp.DefaultUserInfoRequestEncoder" scope="prototype"
+ <bean id="DefaultUserInfoRequestEncoder" scope="prototype"
class="net.shibboleth.idp.plugin.authn.oidc.rp.encoding.impl.DefaultUserInfoRequestEncoder" />
<!-- UserInfo decryption and signature check if JWT type -->
@@ -678,8 +663,6 @@
class="net.shibboleth.oidc.profile.config.navigate.JWTDecryptionConfigurationLookupFunction"
p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
-
-
<bean id="DecryptUserInfoJWE" class="net.shibboleth.oidc.security.impl.DecryptJWE" scope="prototype"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext">
<property name="jwtTokenLookupStrategy">
@@ -689,7 +672,7 @@
<bean class="net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate.UserInfoInUserInfoResponseContextUpdateStrategy" />
</property>
</bean>
-
+
<!--
Note, this is identical in setup to the id_token signature validation flow as they both use the same config and trust engine.
the only difference is the location of the JWT to validate. Maybe they could be merged. Also, the populate steps may or may not
@@ -719,8 +702,7 @@
<bean
class="net.shibboleth.idp.plugin.authn.oidc.rp.metadata.impl.OIDCProviderMetadataLookupHandler"
scope="prototype" p:copyContextStrategy-ref="shibboleth.ChildLookup.OutboundOIDCMetadataContextLookup"
- p:providerMetadataResolver-ref="shibboleth.authn.oidc.rp.ProviderMetadataResolver" />
-
+ p:providerMetadataResolver-ref="shibboleth.authn.oidc.rp.ProviderMetadataResolver" />
<bean class="net.shibboleth.oidc.security.impl.JWTMessageSignatureSecurityHandler"
scope="prototype">
@@ -745,7 +727,7 @@
</property>
</bean>
- <bean id="shibboleth.authn.oidc.rp.DefaultUserInfoTokenLookupStrategy"
+ <bean id="DefaultUserInfoTokenLookupStrategy"
class="net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate.DefaultUserInfoJWTLookupStrategy" />
<bean id="ValidateUserInfoTokenClaims" scope="prototype"
@@ -754,11 +736,11 @@
p:authenticationContextLookupStrategy-ref="ParentAuthenticiationContextLookup"
p:cleanupHook="#{getObject('shibboleth.authn.oidc.rp.userinfo.jwt.claims.CleanUpHook')}"
p:claimsValidator="#{getObject('shibboleth.authn.oidc.rp.userinfo.UserInfoTokenClaimsValidator')
- ?: getObject('shibboleth.authn.oidc.rp.userinfo.DefaultUserInfoTokenClaimsValidator')}"
+ ?: getObject('DefaultUserInfoTokenClaimsValidator')}"
p:jwtLookupStrategy="#{getObject('shibboleth.authn.oidc.rp.userinfo.UserInfoTokenLookupStrategy')
- ?: getObject('shibboleth.authn.oidc.rp.DefaultUserInfoTokenLookupStrategy')}" />
+ ?: getObject('DefaultUserInfoTokenLookupStrategy')}" />
- <bean id="shibboleth.authn.oidc.rp.userinfo.DefaultUserInfoTokenClaimsValidator"
+ <bean id="DefaultUserInfoTokenClaimsValidator"
class="net.shibboleth.oidc.security.jwt.claims.impl.ChainingJWTClaimsValidator"
p:claimValidators-ref="UserInfoClaimsValidators" />
@@ -802,13 +784,13 @@
<bean id="ProcessEndUserClaims" class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.ProcessEndUserClaims"
scope="prototype" p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
p:authenticationContextLookupStrategy-ref="ParentAuthenticiationContextLookup"
- p:claimMergingStrategy="#{getObject('shibboleth.authn.oidc.rp.ClaimMergingStrategy') ?: getObject('shibboleth.authn.oidc.rp.DefaultClaimMergingStrategy')}"
- p:claimSanitizationStrategy="#{getObject('shibboleth.authn.oidc.rp.ClaimSanitizationStrategy') ?: getObject('shibboleth.authn.oidc.rp.DefaultClaimSanitizationStrategy')}" />
+ p:claimMergingStrategy="#{getObject('shibboleth.authn.oidc.rp.ClaimMergingStrategy') ?: getObject('DefaultClaimMergingStrategy')}"
+ p:claimSanitizationStrategy="#{getObject('shibboleth.authn.oidc.rp.ClaimSanitizationStrategy') ?: getObject('DefaultClaimSanitizationStrategy')}" />
- <bean id="shibboleth.authn.oidc.rp.DefaultClaimMergingStrategy"
+ <bean id="DefaultClaimMergingStrategy"
class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.DefaultClaimMergingStrategy" />
- <bean id="shibboleth.authn.oidc.rp.DefaultClaimSanitizationStrategy"
+ <bean id="DefaultClaimSanitizationStrategy"
class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.DefaultClaimSanitizationStrategy" />
<bean id="PostResponsePopulateAuditContext" parent="shibboleth.AbstractPopulateAuditContext"
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-flow.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-flow.xml
index 29aa18d..5b3c8be 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-flow.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-flow.xml
@@ -41,7 +41,6 @@
<evaluate expression="PostRequestPopulateAuditContext" />
<evaluate expression="WriteAuditLog" />
- <!-- <evaluate expression="InitializeMessageChannelSecurityContext" /> -->
<evaluate expression="'proceed'" />
<transition on="proceed" to="RequestObjectRequiredAndSupported" />
</action-state>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list