[java-idp-plugin-oidc-rp] branch main updated: Remove authn prefix part from RP properties
Phil Smart
philip.smart at jisc.ac.uk
Fri Apr 28 13:55:29 UTC 2023
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=da459fd9bf304ae922dc377f2e211838672ec69f
The following commit(s) were added to refs/heads/main by this push:
new da459fd Remove authn prefix part from RP properties
da459fd is described below
commit da459fd9bf304ae922dc377f2e211838672ec69f
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Apr 28 14:55:27 2023 +0100
Remove authn prefix part from RP properties
- still an authn plugin, but may become more general as it develops
- avoids name clutter
---
.../oidc/rp/impl/AuthorizationController.java | 2 +-
.../oidc/rp/impl/ValidateOIDCAuthentication.java | 2 +-
.../META-INF/net.shibboleth.idp/postconfig.xml | 26 ++++-----
.../oidc-relying-party-authn-beans.xml | 12 ++--
.../oidc-relying-party-authn-flow.xml | 2 +-
.../oidc-subject-identifier-c14n-beans.xml | 6 +-
.../authn/oidc-rp-client-secret-credential.xml | 2 +-
.../authn/oidc/rp/conf/authn/oidc-rp.properties | 67 +++++++++++++---------
.../idp/plugin/authn/oidc/rp/module.properties | 46 +++++++--------
.../OIDCRPFlowFromAuthenticationResponseTest.java | 2 +-
.../oidc/rp/impl/OIDCRPFlowPreRedirectTest.java | 12 ++--
.../plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java | 8 +--
.../resources/conf/authn/test-oidc-credentials.xml | 2 +-
.../conf/test-relying-party-postconfig.xml | 22 +++----
14 files changed, 111 insertions(+), 100 deletions(-)
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthorizationController.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthorizationController.java
index 5e5b2e4..f954e13 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthorizationController.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthorizationController.java
@@ -66,7 +66,7 @@ import net.shibboleth.utilities.java.support.logic.Constraint;
*/
@ThreadSafe
@Controller
- at RequestMapping("%{idp.authn.oidc.rp.externalAuthnPath:/Authn/OIDC/RP}")
+ at RequestMapping("%{idp.oidc.rp.externalAuthnPath:/Authn/OIDC/RP}")
public class AuthorizationController extends AbstractInitializableComponent {
/** The final part of the IdP URL path which is called to begin authorization.*/
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateOIDCAuthentication.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateOIDCAuthentication.java
index b42b2cd..63ddcbb 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateOIDCAuthentication.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateOIDCAuthentication.java
@@ -102,7 +102,7 @@ import net.shibboleth.utilities.java.support.service.ServiceableComponent;
public class ValidateOIDCAuthentication extends AbstractValidationAction {
/** Default prefix for metrics. */
- @Nonnull @NotEmpty private static final String DEFAULT_METRIC_NAME = "net.shibboleth.idp.authn.oidc.rp";
+ @Nonnull @NotEmpty private static final String DEFAULT_METRIC_NAME = "net.shibboleth.idp.oidc.rp";
/** Class logger. */
@Nonnull private final Logger log = LoggerFactory.getLogger(ValidateOIDCAuthentication.class);
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 3b9b662..32ab03c 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -208,19 +208,19 @@
<!-- The authentication flow descriptor -->
<bean id="authn/OIDCRelyingParty" parent="shibboleth.AuthenticationFlow"
- p:order="%{idp.authn.oidc.rp.order:1000}" p:nonBrowserSupported="%{idp.authn.oidc.rp.nonBrowserSupported:true}"
- p:passiveAuthenticationSupported="%{idp.authn.oidc.rp.passiveAuthenticationSupported:true}"
- p:forcedAuthenticationSupported="%{idp.authn.oidc.rp.forcedAuthenticationSupported:true}"
- p:proxyRestrictionsEnforced="%{idp.authn.oidc.rp.proxyRestrictionsEnforced:%{idp.authn.enforceProxyRestrictions:true}}"
- p:proxyScopingEnforced="%{idp.authn.oidc.rp.proxyScopingEnforced:false}"
- p:discoveryRequired="%{idp.authn.oidc.rp.discoveryRequired:false}"
- p:lifetime="%{idp.authn.oidc.rp.lifetime:%{idp.authn.defaultLifetime:PT1H}}"
- p:inactivityTimeout="%{idp.authn.oidc.rp.inactivityTimeout:%{idp.authn.defaultTimeout:PT30M}}"
- p:reuseCondition-ref="#{'%{idp.authn.oidc.rp.reuseCondition:shibboleth.Conditions.TRUE}'.trim()}"
- p:activationCondition-ref="#{'%{idp.authn.oidc.rp.activationCondition:shibboleth.Conditions.TRUE}'.trim()}">
+ p:order="%{idp.oidc.rp.order:1000}" p:nonBrowserSupported="%{idp.oidc.rp.nonBrowserSupported:true}"
+ p:passiveAuthenticationSupported="%{idp.oidc.rp.passiveAuthenticationSupported:true}"
+ p:forcedAuthenticationSupported="%{idp.oidc.rp.forcedAuthenticationSupported:true}"
+ p:proxyRestrictionsEnforced="%{idp.oidc.rp.proxyRestrictionsEnforced:%{idp.authn.enforceProxyRestrictions:true}}"
+ p:proxyScopingEnforced="%{idp.oidc.rp.proxyScopingEnforced:false}"
+ p:discoveryRequired="%{idp.oidc.rp.discoveryRequired:false}"
+ p:lifetime="%{idp.oidc.rp.lifetime:%{idp.authn.defaultLifetime:PT1H}}"
+ p:inactivityTimeout="%{idp.oidc.rp.inactivityTimeout:%{idp.authn.defaultTimeout:PT30M}}"
+ p:reuseCondition-ref="#{'%{idp.oidc.rp.reuseCondition:shibboleth.Conditions.TRUE}'.trim()}"
+ p:activationCondition-ref="#{'%{idp.oidc.rp.activationCondition:shibboleth.Conditions.TRUE}'.trim()}">
<property name="supportedPrincipalsByString">
<bean parent="shibboleth.CommaDelimStringArray"
- c:_0="#{'%{idp.authn.oidc.rp.supportedPrincipals:}'.trim()}" />
+ c:_0="#{'%{idp.oidc.rp.supportedPrincipals:}'.trim()}" />
</property>
</bean>
@@ -230,7 +230,7 @@
class="net.shibboleth.idp.authn.SubjectCanonicalizationFlowDescriptor" >
<property name="activationCondition">
<bean class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.SimpleOIDCSubjectIdentifierCanonicalization.ActivationCondition"
- c:disabled="%{idp.authn.oidc.rp.c14n.subjectidentifier.disabled:false}"/>
+ c:disabled="%{idp.oidc.rp.c14n.subjectidentifier.disabled:false}"/>
</property>
</bean>
@@ -243,7 +243,7 @@
<!-- Controller implementation to handle authorization request -->
<bean id="shibboleth.authn.OIDC.externalServletPath" class="java.lang.String"
- c:_0="%{idp.authn.oidc.rp.externalAuthnPath:/Authn/OIDC/RP}">
+ c:_0="%{idp.oidc.rp.externalAuthnPath:/Authn/OIDC/RP}">
</bean>
<!-- location of the OIDC servlet authorization endpoint relative to the servlet -->
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
index b0ef3d7..d8b4e5b 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
@@ -19,7 +19,7 @@
<!-- Initial discovery step -->
<bean id="PropertyDrivenDiscovery" parent="shibboleth.Functions.Constant"
- c:target="#{'%{idp.authn.oidc.rp.provider.proxyIssuer:}'.trim()}" />
+ c:target="#{'%{idp.oidc.rp.provider.proxyIssuer:}'.trim()}" />
<!-- Parent beans for indirecting into nested PRC. -->
@@ -299,7 +299,7 @@
<bean id="DefaultRedirectUriCreationStrategy"
p:callbackServletPath="#{getObject('shibboleth.authn.OIDC.externalServletPath')}/callback"
- p:allowedOrigins="%{idp.authn.oidc.rp.client.redirecturl.allowedOrigins:}"
+ p:allowedOrigins="%{idp.oidc.rp.client.redirecturl.allowedOrigins:}"
class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.DefaultRedirectUriCreationFunction" />
<!-- Message Decoding -->
@@ -586,7 +586,7 @@
c:type="#{ T(net.shibboleth.oidc.profile.messaging.context.OIDCPeerEntityContext) }" />
<bean id="AtHashValidator" class="net.shibboleth.oidc.security.jwt.claims.impl.AccessTokenHashValidator"
- p:allowMissing="%{idp.authn.oidc.rp.client.tokenresponse.allowMissingAtHash:true}"
+ p:allowMissing="%{idp.oidc.rp.client.tokenresponse.allowMissingAtHash:true}"
p:accessTokenLookupStrategy="#{getObject('shibboleth.authn.oidc.rp.jwt.AccessTokenLookupStrategy') ?:
getObject('DefaultAccessTokenLookupStrategy')}"
p:joseHeaderLookupStrategy="#{getObject('shibboleth.authn.oidc.rp.jwt.IDTokenJOSEHeaderLookupStrategy') ?:
@@ -602,13 +602,13 @@
class="net.shibboleth.oidc.security.jwt.claims.impl.AuthenticationTimeClaimsValidator"
p:authnLifetimeLookupStrategy-ref="MaxAgeLookupFunction"
p:authnRequestTimeLookupStrategy-ref="AuthenticationRequestTimeLookupFunction"
- p:clockSkew="%{idp.authn.oidc.rp.client.idtoken.jwt.verifier.clockSkew:PT60S}"
+ p:clockSkew="%{idp.oidc.rp.client.idtoken.jwt.verifier.clockSkew:PT60S}"
p:activationCondition="#{getObject('shibboleth.authn.oidc.rp.jwt.AuthTimeActivationCondition') ?:
getObject('DefaultAuthTimeActivationCondition')}"/>
<bean id="MaxAgeLookupFunction"
class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.MaxAgeLookupFunction"
- c:maxAgeDefault="%{idp.authn.oidc.rp.client.idtoken.jwt.verifier.authnLifetime:PT60S}"/>
+ c:maxAgeDefault="%{idp.oidc.rp.client.idtoken.jwt.verifier.authnLifetime:PT60S}"/>
<bean id="AuthenticationRequestTimeLookupFunction"
class="net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate.AuthenticationRequestTimeLookupFunction"/>
@@ -806,7 +806,7 @@
class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.ValidateOIDCAuthentication" scope="prototype"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
p:authenticationContextLookupStrategy-ref="ParentAuthenticiationContextLookup"
- p:addDefaultPrincipals="#{getObject('idp.authn.oidc.rp.supportedPrincipals.addDefaultPrincipals') ?: %{idp.authn.oidc.rp.addDefaultPrincipals:false}}"
+ p:addDefaultPrincipals="#{getObject('idp.oidc.rp.supportedPrincipals.addDefaultPrincipals') ?: %{idp.oidc.rp.addDefaultPrincipals:false}}"
p:responderLookupStrategy-ref="shibboleth.RelyingPartyIdLookup.Simple"
p:requesterLookupStrategy-ref="shibboleth.ResponderIdLookup.Simple"
p:attributeExtractionStrategy="#{getObject('shibboleth.authn.oidc.rp.attributeExtractionStrategy')}"
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-flow.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-flow.xml
index 5b3c8be..226b721 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-flow.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-flow.xml
@@ -207,7 +207,7 @@
<!-- Route everything out as a graceful failure to allow subsequent options to run. -->
<transition on="#{!'proceed'.equals(currentEvent.id)}" to="ReselectFlow">
<evaluate expression="WriteAuditLogInTransition"/>
- <evaluate expression="T(org.opensaml.core.metrics.MetricsSupport).getMetricRegistry().counter('net.shibboleth.idp.authn.oidc.rp.failures').inc()" />
+ <evaluate expression="T(org.opensaml.core.metrics.MetricsSupport).getMetricRegistry().counter('net.shibboleth.idp.oidc.rp.failures').inc()" />
</transition>
</global-transitions>
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/c14n/OIDCSubjectIdentifier/oidc-subject-identifier-c14n-beans.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/c14n/OIDCSubjectIdentifier/oidc-subject-identifier-c14n-beans.xml
index df39c80..2924cfd 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/c14n/OIDCSubjectIdentifier/oidc-subject-identifier-c14n-beans.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/c14n/OIDCSubjectIdentifier/oidc-subject-identifier-c14n-beans.xml
@@ -20,9 +20,9 @@
<bean id="SimpleOIDCSubjectIdentifierCanonicalization"
class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.SimpleOIDCSubjectIdentifierCanonicalization" scope="prototype"
- p:lowercase="#{getObject('shibboleth.authn.oidc.rp.c14n.subjectidentifier.Lowercase') ?: %{idp.authn.oidc.rp.c14n.subjectidentifier.lowercase:false}}"
- p:uppercase="#{getObject('shibboleth.authn.oidc.rp.c14n.subjectidentifier.Uppercase') ?: %{idp.authn.oidc.rp.c14n.subjectidentifier.uppercas:false}}"
- p:trim="#{getObject('shibboleth.authn.oidc.rp.c14n.subjectidentifier.Trim') ?: %{idp.authn.oidc.rp.c14n.subjectidentifier.trim:true}}"
+ p:lowercase="#{getObject('shibboleth.authn.oidc.rp.c14n.subjectidentifier.Lowercase') ?: %{idp.oidc.rp.c14n.subjectidentifier.lowercase:false}}"
+ p:uppercase="#{getObject('shibboleth.authn.oidc.rp.c14n.subjectidentifier.Uppercase') ?: %{idp.oidc.rp.c14n.subjectidentifier.uppercas:false}}"
+ p:trim="#{getObject('shibboleth.authn.oidc.rp.c14n.subjectidentifier.Trim') ?: %{idp.oidc.rp.c14n.subjectidentifier.trim:true}}"
p:transforms="#{getObject('shibboleth.authn.oidc.rp.c14n.subjectidentifier.Transforms')}" />
</beans>
diff --git a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp-client-secret-credential.xml b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp-client-secret-credential.xml
index 51558fd..1453228 100644
--- a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp-client-secret-credential.xml
+++ b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp-client-secret-credential.xml
@@ -15,6 +15,6 @@
-->
<bean id="shibboleth.authn.oidc.rp.DefaultCredential" parent="shibboleth.oidc.ClientSecretCredential"
- p:secret="%{idp.authn.oidc.rp.client.clientSecret:#{null}}"/>
+ p:secret="%{idp.oidc.rp.client.clientSecret:#{null}}"/>
</beans>
diff --git a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp.properties b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp.properties
index 0fbede1..b92197b 100644
--- a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp.properties
+++ b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp.properties
@@ -1,47 +1,58 @@
-idp.authn.oidc.rp.provider.proxyIssuer=https://issuer.com
+idp.oidc.rp.provider.proxyIssuer=https://issuer.com
## If discovery is required, these default properties will not be set, you must manage per OP using overrides
-idp.authn.oidc.rp.client.clientId = client_id
-idp.authn.oidc.rp.client.clientSecret= client_secret
-#idp.authn.oidc.rp.client.clientSecretExpiresAt = PT0S
-idp.authn.oidc.rp.client.redirecturl.allowedOrigins = https://localhost:8443
-
-#idp.authn.oidc.rp.provider.discoveryRequired=false
-#idp.authn.discoveryURL=http://opdisco.com
-
-#idp.oidc.requestobject.used= false
-#idp.oidc.requestobject.encrypted = false
-#idp.oidc.requestobject.signed = true
+idp.oidc.rp.client.clientId = client_id
+idp.oidc.rp.client.clientSecret= client_secret
+#idp.oidc.rp.client.clientSecretExpiresAt = PT0S
+idp.oidc.rp.client.redirecturl.allowedOrigins = https://localhost:8443
## If true and the token was retrieved using TLS with server validation, JWS signature checking will be skipped.
-#idp.authn.oidc.rp.client.idtoken.tlsServerValidationOnly = false
+#idp.oidc.rp.client.idtoken.tlsServerValidationOnly = false
-#idp.authn.oidc.rp.client.userinfo.enabled = true
-#idp.authn.oidc.rp.client.userinfo.httpRequestMethod = GET
+#idp.oidc.rp.client.userinfo.enabled = true
+#idp.oidc.rp.client.userinfo.httpRequestMethod = GET
## Should validation be skipped if the at_hash is not present in the id_token response. Defaults to 'true' as
## access token at_hash validation is optional in the Authorization Code Flow.
-#idp.authn.oidc.rp.client.tokenresponse.allowMissingAtHash = true
-
-## The OP's keyset document fetch interval i.e. how long should keys from the OP be cached.
-#idp.authn.oidc.rp.provider.keyfetch.interval = PT30M
+#idp.oidc.rp.client.tokenresponse.allowMissingAtHash = true
## Override the default response_mode for the given response_type
-#idp.authn.oidc.rp.client.responseMode = query
-#idp.authn.oidc.rp.client.authenticationMethod = client_secret_basic
+#idp.oidc.rp.client.responseMode = query
+#idp.oidc.rp.client.authenticationMethod = client_secret_basic
## Comma seperated list of additional scopes e.g. profile or email. The openid scope is added by default
-#idp.authn.oidc.rp.client.scopes =
+#idp.oidc.rp.client.scopes =
-#idp.authn.oidc.rp.addDefaultPrincipal = false
-#idp.authn.oidc.rp.supportedPrincipals = \
+#idp.oidc.rp.addDefaultPrincipal = false
+#idp.oidc.rp.supportedPrincipals = \
# saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport, \
# saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:Password, \
# saml1/urn:oasis:names:tc:SAML:1.0:am:password
+## JWT verification properties
+#idp.oidc.rp.client.idtoken.jwt.verifier.clockSkew = PT60S
+#idp.oidc.rp.client.idtoken.jwt.verifier.authnLifetime = PT60S
+
+## External controller path. Should not need changing.
+#idp.oidc.rp.externalAuthnPath = /Authn/OIDC/RP
+
## Inbuilt C14N options for converting a Subject Identifier into a principal name
-idp.authn.oidc.rp.c14n.subjectidentifier.lowercase = false
-idp.authn.oidc.rp.c14n.subjectidentifier.uppercase = false
-idp.authn.oidc.rp.c14n.subjectidentifier.trim = true
-idp.authn.oidc.rp.c14n.subjectidentifier.disabled = false
+idp.oidc.rp.c14n.subjectidentifier.lowercase = false
+idp.oidc.rp.c14n.subjectidentifier.uppercase = false
+idp.oidc.rp.c14n.subjectidentifier.trim = true
+idp.oidc.rp.c14n.subjectidentifier.disabled = false
+
+## Properties to control discovery. Note, there is currently no default discovery implementation
+#idp.oidc.rp.provider.discoveryRequired=false
+#idp.oidc.rp.discoveryURL=http://opdisco.com
+
+### Properties below are common to both RP and OP (if installed).
+
+## The OP's keyset document fetch interval i.e. how long should keys from the OP be cached.
+#idp.oidc.provider.keyfetch.interval = PT30M
+
+## Whether to use a request object to send authentication parameters, and if it should be encrypted and or signed.
+#idp.oidc.requestobject.used= false
+#idp.oidc.requestobject.encrypted = false
+#idp.oidc.requestobject.signed = true
## Signing and encryption/decryption keys for request objects, id tokens, and userinfo response
#idp.signing.oidc.rs.key = %{idp.home}/credentials/idp-signing-rs.jwk
diff --git a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/module.properties b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/module.properties
index 5986923..d84a473 100644
--- a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/module.properties
+++ b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/module.properties
@@ -1,33 +1,33 @@
# Class to Module ID mappings
-net.shibboleth.idp.plugin.authn.oidc.rp.OIDCRPModule = idp.authn.oidc.RP
+net.shibboleth.idp.plugin.authn.oidc.rp.OIDCRPModule = idp.oidc.RP
# Module Owner
-idp.authn.oidc.RP.plugin = net.shibboleth.idp.plugin.authn.oidc.rp
+idp.oidc.RP.plugin = net.shibboleth.idp.plugin.authn.oidc.rp
-idp.authn.oidc.RP.name = OpenID Relying Party Proxy
-idp.authn.oidc.RP.desc = Login flow for java-idp-oidc-rp
-idp.authn.oidc.RP.url = /OIDCRelyingPartyAuthnConfiguration
+idp.oidc.RP.name = OpenID Relying Party Proxy
+idp.oidc.RP.desc = Login flow for java-idp-oidc-rp
+idp.oidc.RP.url = /OIDCRelyingPartyAuthnConfiguration
-idp.authn.oidc.RP.1.src = /net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp.properties
-idp.authn.oidc.RP.1.dest = conf/authn/oidc-rp.properties
-idp.authn.oidc.RP.1.replace = false
+idp.oidc.RP.1.src = /net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp.properties
+idp.oidc.RP.1.dest = conf/authn/oidc-rp.properties
+idp.oidc.RP.1.replace = false
-idp.authn.oidc.RP.2.src = /net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp-config.xml
-idp.authn.oidc.RP.2.dest = conf/authn/oidc-rp-config.xml
-idp.authn.oidc.RP.2.replace = false
+idp.oidc.RP.2.src = /net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp-config.xml
+idp.oidc.RP.2.dest = conf/authn/oidc-rp-config.xml
+idp.oidc.RP.2.replace = false
-idp.authn.oidc.RP.3.src = /net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-credentials.xml
-idp.authn.oidc.RP.3.dest = conf/oidc-credentials.xml
-idp.authn.oidc.RP.3.replace = false
+idp.oidc.RP.3.src = /net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-credentials.xml
+idp.oidc.RP.3.dest = conf/oidc-credentials.xml
+idp.oidc.RP.3.replace = false
-idp.authn.oidc.RP.4.src = /net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp-client-secret-credential.xml
-idp.authn.oidc.RP.4.dest = conf/authn/oidc-rp-client-secret-credential.xml
-idp.authn.oidc.RP.4.replace = false
+idp.oidc.RP.4.src = /net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp-client-secret-credential.xml
+idp.oidc.RP.4.dest = conf/authn/oidc-rp-client-secret-credential.xml
+idp.oidc.RP.4.replace = false
-idp.authn.oidc.RP.5.src = /net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp-providermetadata-resolvers.xml
-idp.authn.oidc.RP.5.dest = conf/authn/oidc-rp-providermetadata-resolvers.xml
-idp.authn.oidc.RP.5.replace = false
+idp.oidc.RP.5.src = /net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp-providermetadata-resolvers.xml
+idp.oidc.RP.5.dest = conf/authn/oidc-rp-providermetadata-resolvers.xml
+idp.oidc.RP.5.replace = false
-idp.authn.oidc.RP.6.src = /net/shibboleth/idp/plugin/authn/oidc/rp/conf/attributes/oidc-claim-rules.xml
-idp.authn.oidc.RP.6.dest = conf/attributes/oidc-claim-rules.xml
-idp.authn.oidc.RP.6.replace = false
\ No newline at end of file
+idp.oidc.RP.6.src = /net/shibboleth/idp/plugin/authn/oidc/rp/conf/attributes/oidc-claim-rules.xml
+idp.oidc.RP.6.dest = conf/attributes/oidc-claim-rules.xml
+idp.oidc.RP.6.replace = false
\ No newline at end of file
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowFromAuthenticationResponseTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowFromAuthenticationResponseTest.java
index b84bf9b..e9095de 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowFromAuthenticationResponseTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowFromAuthenticationResponseTest.java
@@ -77,7 +77,7 @@ public class OIDCRPFlowFromAuthenticationResponseTest extends OIDCRPFlowTest {
final Map<String,String> mockProperties = Map.of(
"idp.entityID", "http://idp.example.com/",
- "idp.authn.oidc.rp.provider.proxyIssuer",OP_ISSUER_ID);
+ "idp.oidc.rp.provider.proxyIssuer",OP_ISSUER_ID);
setMockProperties(mockProperties);
}
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowPreRedirectTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowPreRedirectTest.java
index c87402b..fd28417 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowPreRedirectTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowPreRedirectTest.java
@@ -67,7 +67,7 @@ public class OIDCRPFlowPreRedirectTest extends OIDCRPFlowTest {
final Map<String,String> mockProperties = Map.of(
"idp.service.clientinfo.failFast","false",
"idp.entityID", "http://idp.example.com/",
- "idp.authn.oidc.rp.provider.proxyIssuer",OP_ISSUER_ID);
+ "idp.oidc.rp.provider.proxyIssuer",OP_ISSUER_ID);
setMockProperties(mockProperties);
@@ -117,7 +117,7 @@ public class OIDCRPFlowPreRedirectTest extends OIDCRPFlowTest {
final Map<String,String> mockProperties = Map.of(
"idp.service.clientinfo.failFast","false",
"idp.entityID", "http://idp.example.com/",
- "idp.authn.oidc.rp.provider.proxyIssuer",OP_ISSUER_ID_REQUESTOBJECT_TRUE);
+ "idp.oidc.rp.provider.proxyIssuer",OP_ISSUER_ID_REQUESTOBJECT_TRUE);
setMockProperties(mockProperties);
@@ -169,7 +169,7 @@ public class OIDCRPFlowPreRedirectTest extends OIDCRPFlowTest {
final Map<String,String> mockProperties = Map.of(
"idp.service.clientinfo.failFast","false",
"idp.entityID", "http://idp.example.com/",
- "idp.authn.oidc.rp.provider.proxyIssuer",OP_ISSUER_ID_REQUESTOBJECT_TRUE_ENCRYPT);
+ "idp.oidc.rp.provider.proxyIssuer",OP_ISSUER_ID_REQUESTOBJECT_TRUE_ENCRYPT);
setMockProperties(mockProperties);
@@ -243,7 +243,7 @@ public class OIDCRPFlowPreRedirectTest extends OIDCRPFlowTest {
final Map<String,String> mockProperties = Map.of(
"idp.service.clientinfo.failFast","false",
"idp.entityID", "http://idp.example.com/",
- "idp.authn.oidc.rp.provider.proxyIssuer",OP_ISSUER_ID_REQUESTOBJECT_TRUE_RSA256_SIG);
+ "idp.oidc.rp.provider.proxyIssuer",OP_ISSUER_ID_REQUESTOBJECT_TRUE_RSA256_SIG);
setMockProperties(mockProperties);
@@ -306,7 +306,7 @@ public class OIDCRPFlowPreRedirectTest extends OIDCRPFlowTest {
final Map<String,String> mockProperties = Map.of(
"idp.service.clientinfo.failFast","false",
"idp.entityID", "http://idp.example.com/",
- "idp.authn.oidc.rp.provider.proxyIssuer",OP_ISSUER_ID_REQUESTOBJECT_TRUE_HS512_SIG);
+ "idp.oidc.rp.provider.proxyIssuer",OP_ISSUER_ID_REQUESTOBJECT_TRUE_HS512_SIG);
setMockProperties(mockProperties);
@@ -367,7 +367,7 @@ public class OIDCRPFlowPreRedirectTest extends OIDCRPFlowTest {
final Map<String,String> mockProperties = Map.of(
"idp.service.clientinfo.failFast","false",
"idp.entityID", "http://idp.example.com/",
- "idp.authn.oidc.rp.provider.proxyIssuer",OP_ISSUER_ID);
+ "idp.oidc.rp.provider.proxyIssuer",OP_ISSUER_ID);
setMockProperties(mockProperties);
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java
index dbde6c2..9fcb9fc 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java
@@ -284,8 +284,8 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
// So properties for the profile config need to go here.
loadBeanDefinitionsFromXmlFile(builderContext,
new ClassPathResource("conf/test-relyingparty-resolver-service.xml"),
- Map.of("idp.authn.oidc.rp.client.clientId", CLIENT_ID,
- "idp.authn.oidc.rp.client.redirectURI", REDIRECT_URI_OVERRIDE));
+ Map.of("idp.oidc.rp.client.clientId", CLIENT_ID,
+ "idp.oidc.rp.client.redirectURI", REDIRECT_URI_OVERRIDE));
loadBeanDefinitionsFromXmlFile(builderContext,
new ClassPathResource("conf/additional-system-beans.xml"), null);
@@ -299,8 +299,8 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
// Add a signing key incase it is used
loadBeanDefinitionsFromXmlFile(builderContext,
new ClassPathResource("conf/authn/test-oidc-credentials.xml"), Map.of(
- "idp.authn.oidc.rp.client.clientId", CLIENT_ID,
- "idp.authn.oidc.rp.client.clientSecret",CLIENT_SECRET,
+ "idp.oidc.rp.client.clientId", CLIENT_ID,
+ "idp.oidc.rp.client.clientSecret",CLIENT_SECRET,
"idp.signing.oidc.rs.key","conf/credentials/idp-signing-rsa.jwk"));
}
diff --git a/idp-oidc-rp-impl/src/test/resources/conf/authn/test-oidc-credentials.xml b/idp-oidc-rp-impl/src/test/resources/conf/authn/test-oidc-credentials.xml
index a88514a..03a2673 100644
--- a/idp-oidc-rp-impl/src/test/resources/conf/authn/test-oidc-credentials.xml
+++ b/idp-oidc-rp-impl/src/test/resources/conf/authn/test-oidc-credentials.xml
@@ -20,7 +20,7 @@
The default credential is based on the client_secret, and will be the only used credential in most cases.
-->
<bean id="shibboleth.authn.oidc.rp.DefaultCredential" parent="shibboleth.oidc.ClientSecretCredential"
- p:secret="%{idp.authn.oidc.rp.client.clientSecret:#{null}}"/>
+ p:secret="%{idp.oidc.rp.client.clientSecret:#{null}}"/>
<bean id="shibboleth.oidc.DefaultRSSigningCredential" parent="shibboleth.oidc.JWKCredential"
p:resource="%{idp.signing.oidc.rs.key:#{null}}" p:failIfResourceIsNull="false" />
diff --git a/idp-oidc-rp-impl/src/test/resources/conf/test-relying-party-postconfig.xml b/idp-oidc-rp-impl/src/test/resources/conf/test-relying-party-postconfig.xml
index 6c8cc51..d2433c2 100644
--- a/idp-oidc-rp-impl/src/test/resources/conf/test-relying-party-postconfig.xml
+++ b/idp-oidc-rp-impl/src/test/resources/conf/test-relying-party-postconfig.xml
@@ -46,20 +46,20 @@
p:securityConfiguration-ref="%{idp.security.oidc.config:shibboleth.oidc.DefaultSecurityConfiguration}" />
<bean id="AbstractOIDCSSOProfile" parent="AbstractOIDCProfile" abstract="true"
- p:tokenEndpointAuthMethod="%{idp.authn.oidc.rp.client.authenticationMethod:client_secret_basic}"/>
+ p:tokenEndpointAuthMethod="%{idp.oidc.rp.client.authenticationMethod:client_secret_basic}"/>
<bean id="OIDC.SSO" parent="AbstractOIDCSSOProfile" lazy-init="true"
class="net.shibboleth.oidc.profile.config.impl.DefaultOIDCAuthorizationConfiguration"
- p:httpRequestMethod="%{idp.authn.oidc.rp.httpRequestMethod:GET}"
- p:clientId="#{%{idp.authn.oidc.rp.provider.discoveryRequired:false} == true ? null : '%{idp.authn.oidc.rp.client.clientId:}'}"
- p:clientCredential="#{%{idp.authn.oidc.rp.provider.discoveryRequired:false} == true ? {null} : getObject('shibboleth.authn.oidc.rp.DefaultCredential')}"
- p:responseMode="%{idp.authn.oidc.rp.client.responseMode:#{null}}"
- p:retrieveUserInfoEndpointClaims="%{idp.authn.oidc.rp.client.userinfo.enabled:true}"
- p:redirectUriOverride="%{idp.authn.oidc.rp.client.redirectURI:#{null}}"
- p:encryptRequestObject="%{idp.authn.oidc.rp.client.requestobject.encrypted:false}"
- p:signRequestObject="%{idp.authn.oidc.rp.client.requestobject.signed:true}"
- p:useRequestObject="%{idp.authn.oidc.rp.client.requestobject.supported:false}"
- p:scopes="%{idp.authn.oidc.rp.client.scopes:#{null}}">
+ p:httpRequestMethod="%{idp.oidc.rp.httpRequestMethod:GET}"
+ p:clientId="#{%{idp.oidc.rp.provider.discoveryRequired:false} == true ? null : '%{idp.oidc.rp.client.clientId:}'}"
+ p:clientCredential="#{%{idp.oidc.rp.provider.discoveryRequired:false} == true ? {null} : getObject('shibboleth.authn.oidc.rp.DefaultCredential')}"
+ p:responseMode="%{idp.oidc.rp.client.responseMode:#{null}}"
+ p:retrieveUserInfoEndpointClaims="%{idp.oidc.rp.client.userinfo.enabled:true}"
+ p:redirectUriOverride="%{idp.oidc.rp.client.redirectURI:#{null}}"
+ p:encryptRequestObject="%{idp.oidc.requestobject.encrypted:false}"
+ p:signRequestObject="%{idp.oidc.requestobject.signed:true}"
+ p:useRequestObject="%{idp.oidc.requestobject.used:false}"
+ p:scopes="%{idp.oidc.rp.client.scopes:#{null}}">
<property name="forceAuthnPredicate">
<bean class="net.shibboleth.idp.saml.profile.config.logic.ProxyAwareForceAuthnPredicate" />
</property>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list