[java-idp-plugin-oidc-rp] branch main updated: Move relying party proxy signing resolver to commons
Phil Smart
philip.smart at jisc.ac.uk
Wed Apr 26 13:09:50 UTC 2023
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=2bd624394dda452e6d449ac946bd2e019e6dc9c9
The following commit(s) were added to refs/heads/main by this push:
new 2bd6243 Move relying party proxy signing resolver to commons
2bd6243 is described below
commit 2bd624394dda452e6d449ac946bd2e019e6dc9c9
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Apr 26 14:09:48 2023 +0100
Move relying party proxy signing resolver to commons
---
...RelyingPartyProxySigningParametersResolver.java | 166 ---------------------
.../oidc-relying-party-authn-beans.xml | 8 +-
2 files changed, 4 insertions(+), 170 deletions(-)
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/security/impl/RelyingPartyProxySigningParametersResolver.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/security/impl/RelyingPartyProxySigningParametersResolver.java
deleted file mode 100644
index 1533350..0000000
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/security/impl/RelyingPartyProxySigningParametersResolver.java
+++ /dev/null
@@ -1,166 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.authn.oidc.rp.security.impl;
-
-import java.util.ArrayList;
-import java.util.List;
-import java.util.function.Function;
-import java.util.function.Predicate;
-import java.util.stream.Collectors;
-
-import javax.annotation.Nonnull;
-
-import org.opensaml.security.credential.Credential;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import com.nimbusds.jose.Algorithm;
-import com.nimbusds.jose.JWSAlgorithm;
-import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
-
-import net.shibboleth.oidc.security.credential.ClientSecretCredential;
-import net.shibboleth.oidc.security.jose.SignatureSigningParameters;
-import net.shibboleth.oidc.security.jose.criterion.ClientSecretCredentialCriterion;
-import net.shibboleth.oidc.security.jose.criterion.ProviderMetadataCriterion;
-import net.shibboleth.oidc.security.jose.impl.BasicSignatureSigningParametersResolver;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.logic.FunctionSupport;
-import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
-
-/**
- * A specialization of {@link BasicSignatureSigningParametersResolver} which supports selecting signing credentials
- * from client_secret credential criterion (e.g. from the relying party configuration) in addition to the configured
- * signing credentials inside the signing configuration (determined by the superclass).
- *
- * <p>The OpenID Providers's metadata is also used to filter for those algorithms supported by the OP in addition to
- * those supported by the security configuration.</p>
- *
- * * <p>
- * In addition to the {@link net.shibboleth.utilities.java.support.resolver.Criterion} inputs documented in
- * {@link BasicSignatureSigningParametersResolver}, the following inputs are also supported:
- * </p>
- * <ul>
- * <li>{@link ClientSecretCredentialCriterion} - optional</li>
- * <li>{@link ProviderMetadataCriterion} - required</li>
- * </ul>
- */
-public class RelyingPartyProxySigningParametersResolver extends BasicSignatureSigningParametersResolver {
-
- /** Logger. */
- @Nonnull
- private final Logger log = LoggerFactory.getLogger(RelyingPartyProxySigningParametersResolver.class);
-
- /**
- * A strategy to pull out the correct set of supported algorithms from the {@link OIDCProviderMetadata}.
- * By default returns {@literal null}, signalling 'do not filter'.
- */
- @Nonnull private Function<OIDCProviderMetadata, List<String>> providerMetadataAlgorithmLookupStrategy;
-
- /** Constructor.*/
- public RelyingPartyProxySigningParametersResolver() {
- // Always provide a strategy to avoid NPE, but default returns null e.g. do not filter.
- providerMetadataAlgorithmLookupStrategy = FunctionSupport.constant(null);
- }
-
- /**
- * Set the strategy used to locate the supported signing algorithms from the OP's metadata for this
- * resolver instance. For example, id_token or request object signing algorithms.
- *
- * @param strategy the strategy
- */
- public void setProviderMetadataAlgorithmLookupStrategy(
- @Nonnull final Function<OIDCProviderMetadata, List<String>> strategy) {
- providerMetadataAlgorithmLookupStrategy =
- Constraint.isNotNull(strategy, "ProviderMetadataAlgorithmLookupStrategy can not be null");
- }
-
- // Checkstyle: CyclomaticComplexity|ReturnCount OFF
- @Override
- protected void resolveAndPopulateCredentialAndSignatureAlgorithm(
- @Nonnull final SignatureSigningParameters params,
- @Nonnull final CriteriaSet criteria, @Nonnull final Predicate<String> includeExcludePredicate) {
-
- final List<Credential> allCredentials = new ArrayList<>();
-
- // Add any static credentials from the criteria
- if (criteria.contains(ClientSecretCredentialCriterion.class)) {
- final ClientSecretCredential staticCred =
- criteria.get(ClientSecretCredentialCriterion.class).getCredential();
- log.trace("Client secret signing credential found in criterion");
- // Extract a key suitable for creating and validating MACs
- allCredentials.add(staticCred.toSigningCredential());
- }
-
- // Add any credentials from the configuration
- allCredentials.addAll(getEffectiveSigningCredentials(criteria));
-
- // Get effective signature algorithms from configuration and include/exclude predicate
- final List<String> algorithms = getEffectiveSignatureAlgorithms(criteria, includeExcludePredicate);
- log.debug("Resolved effective signature algorithms from config: '{}'", algorithms);
-
- // Filter by those supported by the upstream OP
- final List<String> supportedAlgorithms = filterForProviderSupportedAlgorithms(criteria, algorithms);
- log.trace("Resolved effective signature algorithms: {}", supportedAlgorithms);
-
- findCompatibleAlgorithmAndCredential(supportedAlgorithms, allCredentials, params);
-
- }
-
- /**
- * Convert the algorithms represented as strings, into Nimbus {@link Algorithm}s for later comparison.
- *
- * @param algos the algorithms to convert
- *
- * @return the converted algorithms
- */
- @Nonnull private List<JWSAlgorithm> convertSupportAlgorithmsToJwkAlgorithms(@Nonnull final List<String> algos) {
- return algos.stream().map(JWSAlgorithm::parse).collect(Collectors.toList());
- }
-
- /**
- * Filter the set of algorithms against the set supported by the OpenID Provider.
- * Always returns a new list reference. The ordering of the input algorithms should be preserved.
- *
- * @param criteria the criteria to extract the OP's metadata from to check supported algorithms.
- * @param algorithms the current set of supported algorithms
- *
- * @return the current set of supported algorithms filtered by those also supported by the OP.
- */
- private List<String> filterForProviderSupportedAlgorithms(
- @Nonnull final CriteriaSet criteria, @Nonnull final List<String> algorithms) {
-
- if (criteria.contains(ProviderMetadataCriterion.class)) {
- final OIDCProviderMetadata metadata = criteria.get(ProviderMetadataCriterion.class).getMetadata();
-
- final List<String> opSupportedAlgNames = providerMetadataAlgorithmLookupStrategy.apply(metadata);
- log.trace("Provider metadata supports the following signature algorithms '{}'",opSupportedAlgNames);
-
- if (opSupportedAlgNames == null) {
- log.trace("Lookup strategy could not determine provider supported algorithms from metadata, "
- + "no further filtering performed");
- return List.copyOf(algorithms);
- }
- return algorithms.stream().filter(opSupportedAlgNames::contains).collect(Collectors.toList());
-
- } else {
- log.debug("No provider metadata criterion, unable to filter for provider supported algorithms");
- return List.copyOf(algorithms);
- }
- }
-
-}
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
index 55cafb3..7abe280 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
@@ -172,8 +172,8 @@
p:signatureSigningParametersResolver-ref="RequestObjectSignatureSigningParametersResolver"
p:activationCondition-ref="SignRequestObjectProxyCondition" />
- <bean id="RequestObjectSignatureSigningParametersResolver"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.security.impl.RelyingPartyProxySigningParametersResolver"
+ <bean id="RequestObjectSignatureSigningParametersResolver" scope="prototype"
+ class="net.shibboleth.oidc.security.jose.impl.RelyingPartySigningParametersResolver"
p:providerMetadataAlgorithmLookupStrategy-ref="RequestObjectSupportedSignatureSigningAlgorithms" />
<bean id="RequestObjectSupportedSignatureSigningAlgorithms" scope="prototype"
@@ -198,7 +198,7 @@
class="net.shibboleth.oidc.profile.config.navigate.JWTEncryptionConfigurationLookupFunction"
p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
- <bean id="EncryptionParametersResolver"
+ <bean id="EncryptionParametersResolver" scope="prototype"
class="net.shibboleth.oidc.security.jose.impl.DefaultEncryptionParametersResolver">
<property name="keyTransportEncryptionAlgorithmsLookupStrategy">
<bean
@@ -391,7 +391,7 @@
p:configurationLookupStrategy-ref="IDTokenDecryptionConfigurationLookup"
p:decryptionParametersResolver-ref="JWTDecryptionParametersResolver" />
- <bean id="JWTDecryptionParametersResolver"
+ <bean id="JWTDecryptionParametersResolver" scope="prototype"
class="net.shibboleth.oidc.security.jose.impl.DefaultDecryptionParametersResolver" />
<bean id="IDTokenDecryptionConfigurationLookup" lazy-init="true"
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list