[java-idp-oidc] branch main updated: Re-ordered the algorithm check to be before the signature validation.

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=406776403935cccdd01140d189060064c2728d69

The following commit(s) were added to refs/heads/main by this push:
     new 40677640 Re-ordered the algorithm check to be before the signature validation.
40677640 is described below

commit 406776403935cccdd01140d189060064c2728d69
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Feb 3 15:51:32 2023 +0200

    Re-ordered the algorithm check to be before the signature validation.
    
    Also switched into using the new name of the algorithm check handler: CheckClientJWTSignatureAlgorithmHandler.
---
 .../flows/authn/OAuth2Client/OAuth2Client-beans.xml    | 18 +++++++++---------
 .../idp/flows/oidc/authorize/authorize-beans.xml       | 18 +++++++++---------
 2 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-beans.xml
index 44844ad2..58291c28 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-beans.xml
@@ -66,8 +66,8 @@
             <bean class="org.opensaml.messaging.handler.impl.BasicMessageHandlerChain">
                 <property name="handlers">
                     <list>
-                        <bean class="net.shibboleth.oidc.security.impl.JWTMessageSignatureSecurityHandler"
-                            scope="prototype">
+                        <bean class="net.shibboleth.oidc.security.impl.CheckClientJWTSignatureAlgorithmHandler"
+                            scope="prototype" p:defaultAlgorithmValue="">
                             <property name="jwtTokenLookupStrategy">
                                 <bean
                                     class="net.shibboleth.idp.profile.context.navigate.SpringExpressionContextLookupFunction"
@@ -81,9 +81,14 @@
                                     c:_0="#{ T(org.opensaml.messaging.context.MessageContext) }"
                                     c:expression="#input.getSubcontext(T(net.shibboleth.oidc.metadata.context.OIDCMetadataContext)).getClientInformation()" />
                             </property>
+                            <property name="signatureAlgorithmLookupStrategy">
+                                <bean
+                                    class="net.shibboleth.oidc.profile.config.navigate.ClientInformationStringValueLookupFunction"
+                                    c:keyName="token_endpoint_auth_signing_alg" />
+                            </property>
                         </bean>
-                        <bean class="net.shibboleth.oidc.security.impl.ClientInformationJWTSignatureAlgorithmSecurityHandler"
-                            scope="prototype" p:defaultAlgorithmValue="">
+                        <bean class="net.shibboleth.oidc.security.impl.JWTMessageSignatureSecurityHandler"
+                            scope="prototype">
                             <property name="jwtTokenLookupStrategy">
                                 <bean
                                     class="net.shibboleth.idp.profile.context.navigate.SpringExpressionContextLookupFunction"
@@ -97,11 +102,6 @@
                                     c:_0="#{ T(org.opensaml.messaging.context.MessageContext) }"
                                     c:expression="#input.getSubcontext(T(net.shibboleth.oidc.metadata.context.OIDCMetadataContext)).getClientInformation()" />
                             </property>
-                            <property name="signatureAlgorithmLookupStrategy">
-                                <bean
-                                    class="net.shibboleth.oidc.profile.config.navigate.ClientInformationStringValueLookupFunction"
-                                    c:keyName="token_endpoint_auth_signing_alg" />
-                            </property>
                         </bean>
                     </list>
                 </property>
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
index 1be02844..59816c26 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
@@ -137,8 +137,8 @@
             <bean class="org.opensaml.messaging.handler.impl.BasicMessageHandlerChain">
                 <property name="handlers">
                     <list>
-                        <bean class="net.shibboleth.oidc.security.impl.JWTMessageSignatureSecurityHandler"
-                            scope="prototype">
+                        <bean class="net.shibboleth.oidc.security.impl.CheckClientJWTSignatureAlgorithmHandler"
+                            scope="prototype" p:defaultAlgorithmValue="">
                             <property name="jwtTokenLookupStrategy">
                                 <bean
                                     class="net.shibboleth.idp.profile.context.navigate.SpringExpressionContextLookupFunction"
@@ -152,9 +152,14 @@
                                     c:_0="#{ T(org.opensaml.messaging.context.MessageContext) }"
                                     c:expression="#input.getSubcontext(T(net.shibboleth.oidc.metadata.context.OIDCMetadataContext)).getClientInformation()" />
                             </property>
+                            <property name="signatureAlgorithmLookupStrategy">
+                                <bean
+                                    class="net.shibboleth.oidc.profile.config.navigate.ClientInformationStringValueLookupFunction"
+                                    c:keyName="request_object_signing_alg" />
+                            </property>
                         </bean>
-                        <bean class="net.shibboleth.oidc.security.impl.ClientInformationJWTSignatureAlgorithmSecurityHandler"
-                            scope="prototype" p:defaultAlgorithmValue="">
+                        <bean class="net.shibboleth.oidc.security.impl.JWTMessageSignatureSecurityHandler"
+                            scope="prototype">
                             <property name="jwtTokenLookupStrategy">
                                 <bean
                                     class="net.shibboleth.idp.profile.context.navigate.SpringExpressionContextLookupFunction"
@@ -168,11 +173,6 @@
                                     c:_0="#{ T(org.opensaml.messaging.context.MessageContext) }"
                                     c:expression="#input.getSubcontext(T(net.shibboleth.oidc.metadata.context.OIDCMetadataContext)).getClientInformation()" />
                             </property>
-                            <property name="signatureAlgorithmLookupStrategy">
-                                <bean
-                                    class="net.shibboleth.oidc.profile.config.navigate.ClientInformationStringValueLookupFunction"
-                                    c:keyName="request_object_signing_alg" />
-                            </property>
                         </bean>
                     </list>
                 </property>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.