[java-idp-oidc] 03/03: JCOMOIDC-48 - Move OIDC.SSO profile bean to commons
Henri Mikkonen
henri.mikkonen at iki.fi
Fri Feb 3 13:19:07 UTC 2023
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=38c2d2c12b165a27d48e64e1b1e475c9c5b7fea6
commit 38c2d2c12b165a27d48e64e1b1e475c9c5b7fea6
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Feb 3 15:16:45 2023 +0200
JCOMOIDC-48 - Move OIDC.SSO profile bean to commons
https://shibboleth.atlassian.net/browse/JCOMOIDC-48
Inherit OIDC.SSO, OIDC.Keyset, AbstractOIDCProfile, AbstractOIDCSSOProfile and
default security configurations from commons.
---
.../authn/OAuth2Client/OAuth2Client-beans.xml | 57 +++-
.../idp/flows/oidc/authorize/authorize-beans.xml | 57 +++-
.../idp/service/relying-party/postconfig.xml | 350 +--------------------
.../op/profile/flow/ConfigurationFlowTest.java | 3 +-
4 files changed, 94 insertions(+), 373 deletions(-)
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-beans.xml
index 85cfc9fc..44844ad2 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-beans.xml
@@ -62,21 +62,48 @@
<bean id="ValidateJWTSignature" class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor"
scope="prototype" c:executionDirection="INBOUND" p:activationCondition-ref="JWTAuthenticationCondition"
p:errorEvent="#{T(net.shibboleth.idp.authn.AuthnEventIds).AUTHN_EXCEPTION}">
- <constructor-arg name="messageHandler">
- <bean class="net.shibboleth.oidc.security.impl.JWTMessageSignatureSecurityHandler"
- scope="prototype">
- <property name="jwtTokenLookupStrategy">
- <bean
- class="net.shibboleth.idp.profile.context.navigate.SpringExpressionContextLookupFunction"
- c:_0="#{ T(org.opensaml.messaging.context.MessageContext) }"
- c:outputType="#{T(com.nimbusds.jwt.SignedJWT)}"
- c:expression="#input.getParent().getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).getSubcontext(T(net.shibboleth.oidc.authn.context.OAuth2ClientAuthenticationContext)).getClientAuthentication().getClientAssertion()" />
- </property>
- <property name="clientInformationLookupStrategy">
- <bean
- class="net.shibboleth.idp.profile.context.navigate.SpringExpressionContextLookupFunction"
- c:_0="#{ T(org.opensaml.messaging.context.MessageContext) }"
- c:expression="#input.getSubcontext(T(net.shibboleth.oidc.metadata.context.OIDCMetadataContext)).getClientInformation()" />
+ <constructor-arg>
+ <bean class="org.opensaml.messaging.handler.impl.BasicMessageHandlerChain">
+ <property name="handlers">
+ <list>
+ <bean class="net.shibboleth.oidc.security.impl.JWTMessageSignatureSecurityHandler"
+ scope="prototype">
+ <property name="jwtTokenLookupStrategy">
+ <bean
+ class="net.shibboleth.idp.profile.context.navigate.SpringExpressionContextLookupFunction"
+ c:_0="#{ T(org.opensaml.messaging.context.MessageContext) }"
+ c:outputType="#{T(com.nimbusds.jwt.SignedJWT)}"
+ c:expression="#input.getParent().getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).getSubcontext(T(net.shibboleth.oidc.authn.context.OAuth2ClientAuthenticationContext)).getClientAuthentication().getClientAssertion()" />
+ </property>
+ <property name="clientInformationLookupStrategy">
+ <bean
+ class="net.shibboleth.idp.profile.context.navigate.SpringExpressionContextLookupFunction"
+ c:_0="#{ T(org.opensaml.messaging.context.MessageContext) }"
+ c:expression="#input.getSubcontext(T(net.shibboleth.oidc.metadata.context.OIDCMetadataContext)).getClientInformation()" />
+ </property>
+ </bean>
+ <bean class="net.shibboleth.oidc.security.impl.ClientInformationJWTSignatureAlgorithmSecurityHandler"
+ scope="prototype" p:defaultAlgorithmValue="">
+ <property name="jwtTokenLookupStrategy">
+ <bean
+ class="net.shibboleth.idp.profile.context.navigate.SpringExpressionContextLookupFunction"
+ c:_0="#{ T(org.opensaml.messaging.context.MessageContext) }"
+ c:outputType="#{T(com.nimbusds.jwt.SignedJWT)}"
+ c:expression="#input.getParent().getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).getSubcontext(T(net.shibboleth.oidc.authn.context.OAuth2ClientAuthenticationContext)).getClientAuthentication().getClientAssertion()" />
+ </property>
+ <property name="clientInformationLookupStrategy">
+ <bean
+ class="net.shibboleth.idp.profile.context.navigate.SpringExpressionContextLookupFunction"
+ c:_0="#{ T(org.opensaml.messaging.context.MessageContext) }"
+ c:expression="#input.getSubcontext(T(net.shibboleth.oidc.metadata.context.OIDCMetadataContext)).getClientInformation()" />
+ </property>
+ <property name="signatureAlgorithmLookupStrategy">
+ <bean
+ class="net.shibboleth.oidc.profile.config.navigate.ClientInformationStringValueLookupFunction"
+ c:keyName="token_endpoint_auth_signing_alg" />
+ </property>
+ </bean>
+ </list>
</property>
</bean>
</constructor-arg>
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
index c0277d93..1be02844 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
@@ -133,21 +133,48 @@
<bean id="ValidateRequestObjectSignature" class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor"
scope="prototype" c:executionDirection="INBOUND" p:activationCondition-ref="RequestObjectSignedCondition">
- <constructor-arg name="messageHandler">
- <bean class="net.shibboleth.oidc.security.impl.JWTMessageSignatureSecurityHandler"
- scope="prototype">
- <property name="jwtTokenLookupStrategy">
- <bean
- class="net.shibboleth.idp.profile.context.navigate.SpringExpressionContextLookupFunction"
- c:_0="#{ T(org.opensaml.messaging.context.MessageContext) }"
- c:outputType="#{T(com.nimbusds.jwt.SignedJWT)}"
- c:expression="#input.getParent().getOutboundMessageContext().getSubcontext(T(net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext)).getRequestObject()" />
- </property>
- <property name="clientInformationLookupStrategy">
- <bean
- class="net.shibboleth.idp.profile.context.navigate.SpringExpressionContextLookupFunction"
- c:_0="#{ T(org.opensaml.messaging.context.MessageContext) }"
- c:expression="#input.getSubcontext(T(net.shibboleth.oidc.metadata.context.OIDCMetadataContext)).getClientInformation()" />
+ <constructor-arg>
+ <bean class="org.opensaml.messaging.handler.impl.BasicMessageHandlerChain">
+ <property name="handlers">
+ <list>
+ <bean class="net.shibboleth.oidc.security.impl.JWTMessageSignatureSecurityHandler"
+ scope="prototype">
+ <property name="jwtTokenLookupStrategy">
+ <bean
+ class="net.shibboleth.idp.profile.context.navigate.SpringExpressionContextLookupFunction"
+ c:_0="#{ T(org.opensaml.messaging.context.MessageContext) }"
+ c:outputType="#{T(com.nimbusds.jwt.SignedJWT)}"
+ c:expression="#input.getParent().getOutboundMessageContext().getSubcontext(T(net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext)).getRequestObject()" />
+ </property>
+ <property name="clientInformationLookupStrategy">
+ <bean
+ class="net.shibboleth.idp.profile.context.navigate.SpringExpressionContextLookupFunction"
+ c:_0="#{ T(org.opensaml.messaging.context.MessageContext) }"
+ c:expression="#input.getSubcontext(T(net.shibboleth.oidc.metadata.context.OIDCMetadataContext)).getClientInformation()" />
+ </property>
+ </bean>
+ <bean class="net.shibboleth.oidc.security.impl.ClientInformationJWTSignatureAlgorithmSecurityHandler"
+ scope="prototype" p:defaultAlgorithmValue="">
+ <property name="jwtTokenLookupStrategy">
+ <bean
+ class="net.shibboleth.idp.profile.context.navigate.SpringExpressionContextLookupFunction"
+ c:_0="#{ T(org.opensaml.messaging.context.MessageContext) }"
+ c:outputType="#{T(com.nimbusds.jwt.SignedJWT)}"
+ c:expression="#input.getParent().getOutboundMessageContext().getSubcontext(T(net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext)).getRequestObject()" />
+ </property>
+ <property name="clientInformationLookupStrategy">
+ <bean
+ class="net.shibboleth.idp.profile.context.navigate.SpringExpressionContextLookupFunction"
+ c:_0="#{ T(org.opensaml.messaging.context.MessageContext) }"
+ c:expression="#input.getSubcontext(T(net.shibboleth.oidc.metadata.context.OIDCMetadataContext)).getClientInformation()" />
+ </property>
+ <property name="signatureAlgorithmLookupStrategy">
+ <bean
+ class="net.shibboleth.oidc.profile.config.navigate.ClientInformationStringValueLookupFunction"
+ c:keyName="request_object_signing_alg" />
+ </property>
+ </bean>
+ </list>
</property>
</bean>
</constructor-arg>
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index 3e410f2a..0356dd18 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -11,56 +11,14 @@
default-init-method="initialize" default-destroy-method="destroy">
- <!--
- Security Configuration Defaults. These settings establish the default security configurations for
- signatures and loads the default credentials used.
- -->
- <bean id="shibboleth.oidc.BasicSignatureValidationConfiguration" abstract="true"
- class="net.shibboleth.oidc.security.jose.impl.BasicSignatureValidationConfiguration"
- p:includedAlgorithms="#{getObject('shibboleth.oidc.IncludedSignatureAlgorithms')}"
- p:excludedAlgorithms="#{getObject('shibboleth.oidc.ExcludedSignatureAlgorithms')}" />
-
- <bean id="shibboleth.oidc.BasicSignatureSigningConfiguration" abstract="true"
- class="net.shibboleth.oidc.security.jose.impl.BasicSignatureSigningConfiguration"
- p:includedAlgorithms="#{getObject('shibboleth.oidc.IncludedSignatureAlgorithms')}"
- p:excludedAlgorithms="#{getObject('shibboleth.oidc.ExcludedSignatureAlgorithms')}" />
-
- <bean id="shibboleth.oidc.BasicEncryptionConfiguration" abstract="true"
- class="net.shibboleth.oidc.security.jose.impl.BasicEncryptionConfiguration"
- p:includedAlgorithms="#{getObject('shibboleth.oidc.IncludedEncryptionAlgorithms')}"
- p:excludedAlgorithms="#{getObject('shibboleth.oidc.ExcludedEncryptionAlgorithms')}" />
-
- <bean id="shibboleth.oidc.BasicDecryptionConfiguration" abstract="true"
- class="net.shibboleth.oidc.security.jose.impl.BasicDecryptionConfiguration"
- p:includedAlgorithms="#{getObject('shibboleth.oidc.IncludedEncryptionAlgorithms')}"
- p:excludedAlgorithms="#{getObject('shibboleth.oidc.ExcludedEncryptionAlgorithms')}" />
-
<!-- OIDC Profile Configurations. -->
-
- <bean id="AbstractOIDCProfile" abstract="true"
- p:securityConfiguration-ref="%{idp.security.oidc.config:shibboleth.oidc.DefaultSecurityConfiguration}" />
-
- <bean id="AbstractOIDCSSOProfile" parent="AbstractOIDCProfile" abstract="true"
- p:issuer-ref="shibboleth.oidc.issuer"
- p:tokenEndpointAuthMethods="%{idp.oidc.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}"
- p:claimsValidator-ref="DefaultJWTClaimsValidator"
- p:encryptionOptional="%{idp.oidc.encryptionOptional:true}"
- p:forcePKCE="%{idp.oidc.forcePKCE:false}"
- p:allowPKCEPlain="%{idp.oidc.allowPKCEPlain:false}"
- p:iDTokenLifetime="%{idp.oidc.idToken.defaultLifetime:PT1H}"
- p:accessTokenType="%{idp.oauth2.accessToken.type:}"
- p:accessTokenLifetime="%{idp.oidc.accessToken.defaultLifetime:PT10M}"
- p:refreshTokenLifetime="%{idp.oidc.refreshToken.defaultLifetime:PT2H}"
- p:alwaysIncludedAttributes="%{idp.oidc.alwaysIncludedAttributes:}" />
-
- <!-- The final three are really token endpoint settings and should be removed eventually. -->
- <bean id="OIDC.SSO" parent="AbstractOIDCSSOProfile" lazy-init="true"
- class="net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration"
- p:authorizeCodeLifetime="%{idp.oidc.authorizeCode.defaultLifetime:PT5M}"
- p:encodeConsentInTokens="%{idp.oidc.encodeConsentInTokens:false}"
- p:encodedAttributes="%{idp.oidc.encodedAttributes:%{idp.oidc.embeddedAttributes:}}"
- p:deniedUserInfoAttributes="%{idp.oidc.deniedUserInfoAttributes:}"
- p:securityConfiguration-ref="%{idp.security.oidc.authorize.config:shibboleth.oidc.authorize.DefaultSecurityConfiguration}" />
+ <!-- The following are inherited from java-oidc-common:
+ - AbstractOIDCProfile
+ - AbstractOIDCSSOProfile
+ - OIDC.SSO
+ - OIDC.Keyset
+ - Default security configurations
+ -->
<bean id="OIDC.UserInfo" parent="AbstractOIDCProfile" lazy-init="true"
class="net.shibboleth.oidc.profile.config.OIDCUserInfoConfiguration"
@@ -82,10 +40,6 @@
class="net.shibboleth.oidc.profile.config.OIDCProviderInformationConfiguration"
p:issuer-ref="shibboleth.oidc.issuer" />
- <bean id="OIDC.Keyset" parent="AbstractOIDCProfile" lazy-init="true"
- class="net.shibboleth.oidc.profile.config.OIDCPublishKeySetConfiguration"
- p:securityConfiguration-ref="shibboleth.oidc.PublishKeySetSecurityConfiguration" />
-
<bean id="OAUTH2.Token" parent="AbstractOIDCSSOProfile" lazy-init="true"
class="net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenConfiguration"
p:grantTypes="%{idp.oauth2.grantTypes:authorization_code,refresh_token}"
@@ -334,7 +288,7 @@
<property name="securityConfigurationLookupStrategy">
<bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="securityConfiguration"
p:propertyType="#{T(net.shibboleth.idp.profile.config.SecurityConfiguration)}"
- p:defaultValue-ref="%{idp.security.oidc.authorize.config:shibboleth.oidc.authorize.DefaultSecurityConfiguration}" />
+ p:defaultValue-ref="%{idp.security.oidc.authorize.config:shibboleth.oidc.DefaultSecurityConfiguration}" />
</property>
</bean>
@@ -710,294 +664,6 @@
<qualifier value="encryption"/>
</bean>
- <!--
- Security Configuration Defaults. These settings establish the default security
- configurations for signatures and loads the default credentials used.
- -->
-
- <bean id="shibboleth.oidc.DefaultSecurityConfiguration"
- class="net.shibboleth.oidc.profile.config.JSONSecurityConfiguration">
- <property name="jwtSignatureSigningConfiguration">
- <ref bean="#{'%{idp.oidc.signing.config:shibboleth.oidc.SigningConfiguration}'.trim()}" />
- </property>
- <property name="jwtEncryptionConfiguration">
- <ref bean="#{'%{idp.oidc.encryption.config:shibboleth.oidc.EncryptionConfiguration}'.trim()}" />
- </property>
- <property name="jwtDecryptionConfiguration">
- <ref bean="#{'%{idp.oidc.rodecrypt.config:shibboleth.oidc.DecryptionConfiguration}'.trim()}" />
- </property>
- <property name="jwtSignatureValidationConfiguration">
- <ref bean="#{'%{idp.oidc.tevalid.config:shibboleth.oidc.SignatureValidationConfiguration}'.trim()}" />
- </property>
- </bean>
-
- <bean id="shibboleth.oidc.authorize.DefaultSecurityConfiguration"
- class="net.shibboleth.oidc.profile.config.JSONSecurityConfiguration">
- <property name="jwtSignatureSigningConfiguration">
- <ref bean="#{'%{idp.oidc.signing.config:shibboleth.oidc.SigningConfiguration}'.trim()}" />
- </property>
- <property name="jwtEncryptionConfiguration">
- <ref bean="#{'%{idp.oidc.encryption.config:shibboleth.oidc.EncryptionConfiguration}'.trim()}" />
- </property>
- <property name="jwtDecryptionConfiguration">
- <ref bean="#{'%{idp.oidc.rodecrypt.config:shibboleth.oidc.DecryptionConfiguration}'.trim()}" />
- </property>
- <property name="jwtSignatureValidationConfiguration">
- <ref bean="#{'%{idp.oidc.rovalid.config:shibboleth.oidc.ro.SignatureValidationConfiguration}'.trim()}" />
- </property>
- </bean>
-
- <!-- Configuration for credentials and supported algorithms for ID Token and UserInfo response signing. -->
- <bean id="shibboleth.oidc.SigningConfiguration" parent="shibboleth.oidc.BasicSignatureSigningConfiguration"
- p:signingCredentials="#{getObject('shibboleth.oidc.SigningCredentials')}">
- <property name="signatureAlgorithms">
- <list>
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_RS_256" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_RS_384" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_RS_512" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_ES_256" />
-
- <!--
- Not supported by the default P-256 EC key. P-384 and P-512 need to be added as credential if activated.
-
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_ES_384" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_ES_512" />
- -->
-
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_HS_256" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_HS_384" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_HS_512" />
- </list>
- </property>
- </bean>
-
- <!-- Configuration for supported algorithms for ID Token and UserInfo response encryption. -->
- <bean id="shibboleth.oidc.EncryptionConfiguration" parent="shibboleth.oidc.BasicEncryptionConfiguration"
- p:KEKCredentialResolver-ref="defaultOIDCKeyEncryptionCredentialResolver"
- p:contentEncryptionKeyCredentialResolver-ref="defaultOIDCContentEncryptionKeyCredentialResolver">
- <property name="keyTransportEncryptionAlgorithms">
- <list>
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_RSA_1_5" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_RSA_OAEP" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_RSA_OAEP_256" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_128_KW" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_192_KW" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_256_KW" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_128_GCM_KW" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_192_GCM_KW" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_256_GCM_KW" />
- </list>
- </property>
- <property name="dataEncryptionAlgorithms">
- <list>
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A128CBC_HS256" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A192CBC_HS384" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A256CBC_HS512" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A128GCM" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A192GCM" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A256GCM" />
- </list>
- </property>
- </bean>
-
- <bean id="defaultOIDCKeyEncryptionCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
- <constructor-arg>
- <list>
- <bean id="ClientInformationCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.ClientInformationCredentialResolver"
- p:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache"
- p:keyFetchInterval="%{idp.oidc.provider.keyfetch.interval:PT30M}"/>
-<!-- <bean id="CriterionCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.CriterionCredentialResolver" />-->
- </list>
- </constructor-arg>
- </bean>
-
- <!--
- A resolver to resolve pre-shared Direct Encryption or Key Wrapping credentials based on the
- client_secret in the input criterion. Returns the raw value, even though the key to use
- is a derivative of this key.
- -->
- <bean id="defaultOIDCContentEncryptionKeyCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
- <constructor-arg>
- <list>
- <bean id="ClientInformationCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.ClientInformationCredentialResolver"
- p:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache"
- p:keyFetchInterval="%{idp.oidc.provider.keyfetch.interval:PT30M}"/>
-<!-- <bean id="CriterionCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.CriterionCredentialResolver" />-->
- </list>
- </constructor-arg>
- </bean>
-
- <!-- Configuration for credentials and supported algorithms for request object decryption. -->
- <bean id="shibboleth.oidc.DecryptionConfiguration"
- parent="shibboleth.oidc.BasicDecryptionConfiguration"
- p:KEKCredentialResolver-ref="defaultOIDCKeyDecryptionCredentialResolver"
- p:contentEncryptionKeyCredentialResolver-ref="defaultOIDCContentDecryptionKeyCredentialResolver">
- </bean>
-
- <!--
- A resolver to resolve a pre-shared Direct Encryption key e.g. a pairwise client_secret from the input criterion
- from which to derive the decryption key.
- -->
- <bean id="defaultOIDCContentDecryptionKeyCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
- <constructor-arg>
- <list>
- <bean id="CriterionCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.ClientSecretCriterionCredentialResolver" />
- </list>
- </constructor-arg>
- </bean>
-
- <!--
- A resolver to public/private key encryption keys global to the RP
- -->
- <bean id="defaultOIDCKeyDecryptionCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
- <constructor-arg>
- <list>
- <bean class="net.shibboleth.oidc.security.credential.impl.LocalJOSEObjectCredentialResolver">
- <constructor-arg name="localCredentialResolver">
- <bean
- class="net.shibboleth.oidc.security.credential.impl.CollectionJOSEObjectCredentialResolver"
- c:credentials-ref="shibboleth.oidc.EncryptionCredentials" />
- </constructor-arg>
- </bean>
- <bean id="CriterionCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.ClientSecretCriterionCredentialResolver" />
- </list>
- </constructor-arg>
- </bean>
-
- <!-- Configuration for supported algorithms for request object signature validation. -->
- <bean id="shibboleth.oidc.SignatureValidationConfiguration" parent="shibboleth.oidc.BasicSignatureValidationConfiguration"
- p:signatureTrustEngine-ref="ClientInformationTokenEndpointAuthJWTTrustEngine">
-<!--
- <property name="signatureAlgorithms">
- <list>
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_RS_256" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_RS_384" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_RS_512" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_ES_256" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_ES_384" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_ES_512" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_HS_256" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_HS_384" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_HS_512" />
- </list>
- </property>
--->
- </bean>
-
- <!-- Configuration for supported algorithms for request object signature validation. -->
- <bean id="shibboleth.oidc.ro.SignatureValidationConfiguration" parent="shibboleth.oidc.BasicSignatureValidationConfiguration"
- p:signatureTrustEngine-ref="ClientInformationRequestObjectJWTTrustEngine">
- </bean>
-
- <!-- A resolver for resolving trusted credentials to match against those resolved from the JWT -->
- <bean id="defaultSignedJWTTrustedCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
- <constructor-arg>
- <list>
- <bean id="ClientInformationCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.ClientInformationCredentialResolver"
- p:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache"
- p:keyFetchInterval="%{idp.oidc.provider.keyfetch.interval:PT30M}"/>
- <bean id="CriterionCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.ClientSecretCriterionCredentialResolver" />
- </list>
- </constructor-arg>
- </bean>
-
- <!-- A resolver for resolving 'untrusted' credentials out of the JOSE header of JWTs -->
- <bean id="defaultSignedJWTJOSEHeaderCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver" />
-
- <bean id="ClientInformationTokenEndpointAuthJWTTrustEngine"
- class="net.shibboleth.oidc.security.impl.ClientInformationJWTTrustEngine"
- c:resolver-ref="defaultSignedJWTTrustedCredentialResolver"
- c:JOSEObjectResolver-ref="defaultSignedJWTJOSEHeaderCredentialResolver">
- <constructor-arg name="signatureAlgorithmLookupStrategy">
- <bean
- class="net.shibboleth.oidc.profile.config.navigate.ClientInformationStringValueLookupFunction"
- c:keyName="token_endpoint_auth_signing_alg" />
- </constructor-arg>
- <constructor-arg name="defaultAlgorithmValue" value="" />
- </bean>
-
- <bean id="ClientInformationRequestObjectJWTTrustEngine"
- class="net.shibboleth.oidc.security.impl.ClientInformationJWTTrustEngine"
- c:resolver-ref="defaultSignedJWTTrustedCredentialResolver"
- c:JOSEObjectResolver-ref="defaultSignedJWTJOSEHeaderCredentialResolver">
- <constructor-arg name="signatureAlgorithmLookupStrategy">
- <bean
- class="net.shibboleth.oidc.profile.config.navigate.ClientInformationStringValueLookupFunction"
- c:keyName="request_object_signing_alg" />
- </constructor-arg>
- <constructor-arg name="defaultAlgorithmValue" value="" />
- </bean>
-
- <!-- Configuration for publishing key set. -->
- <bean id="shibboleth.oidc.PublishKeySetSecurityConfiguration"
- class="net.shibboleth.oidc.profile.config.JSONSecurityConfiguration">
- <property name="jwtSignatureSigningConfiguration">
- <ref bean="shibboleth.oidc.PublishKeySetSigningConfiguration" />
- </property>
- <property name="jwtDecryptionConfiguration">
- <ref bean="shibboleth.oidc.PublishKeySetDecryptionConfiguration" />
- </property>
- </bean>
-
- <!-- Signing keys to publish. -->
- <bean id="shibboleth.oidc.PublishKeySetSigningConfiguration" parent="shibboleth.oidc.BasicSignatureSigningConfiguration"
- p:signingCredentials="#{getObject('shibboleth.oidc.SigningCredentialsToPublish') ?: getObject('shibboleth.oidc.SigningCredentials')}"/>
-
- <!-- Encryption keys to publish. -->
- <bean id="shibboleth.oidc.PublishKeySetDecryptionConfiguration" parent="shibboleth.oidc.BasicDecryptionConfiguration">
- <property name="KEKCredentialResolver">
- <bean class="net.shibboleth.oidc.security.credential.impl.ReturnAllCollectionJOSEObjectCredentialResolver"
- c:credentials="#{getObject('shibboleth.oidc.EncryptionCredentialsToPublish') ?: getObject('shibboleth.oidc.EncryptionCredentials')}"/>
- </property>
- </bean>
-
<bean id="shibboleth.oidc.dyngreg.DefaultMetadataPolicyFilename" class="java.lang.String" factory-method="valueOf">
<constructor-arg value="%{idp.oidc.dynreg.defaultMetadataPolicyFile:}" />
</bean>
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ConfigurationFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ConfigurationFlowTest.java
index 17d82f50..1d3a75d5 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ConfigurationFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ConfigurationFlowTest.java
@@ -68,7 +68,8 @@ public class ConfigurationFlowTest extends AbstractOidcFlowTest {
"A128GCMKW", "A192GCMKW", "A256GCMKW");
final List<String> jweEncs = Arrays.asList("A128CBC-HS256", "A192CBC-HS384", "A256CBC-HS512", "A128GCM",
"A192GCM", "A256GCM");
- final List<String> jwsAlgs = Arrays.asList("RS256", "RS384", "RS512", "ES256", "HS256", "HS384", "HS512");
+ final List<String> jwsAlgs = Arrays.asList("RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "HS256",
+ "HS384", "HS512");
Assert.assertNotNull(metadata.getIDTokenJWEAlgs());
Assert.assertTrue(containsAll(metadata.getIDTokenJWEAlgs(), jweAlgs));
Assert.assertNotNull(metadata.getIDTokenJWEAlgs());
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list