[java-idp-plugin-oidc-rp] branch main updated: Changes to support JCOMOIDC-60 and JCOMOIDC-62
Phil Smart
philip.smart at jisc.ac.uk
Fri Feb 3 13:57:28 UTC 2023
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=5a8fb46dc8226ed371f7c094a51f081da566d8b8
The following commit(s) were added to refs/heads/main by this push:
new 5a8fb46 Changes to support JCOMOIDC-60 and JCOMOIDC-62
5a8fb46 is described below
commit 5a8fb46dc8226ed371f7c094a51f081da566d8b8
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Feb 3 13:57:24 2023 +0000
Changes to support JCOMOIDC-60 and JCOMOIDC-62
- Also many small cleanups and some package restructures
---
.../authn/oidc/rp/config/logic/package-info.java | 2 +-
...nticationContextClassRequestLookupFunction.java | 114 ------
...ticationContextClassResponseLookupFunction.java | 115 ------
.../rp/context/AccessTokenResponseContext.java | 5 +-
.../ClientIDFromOAuth2ClientContextFunction.java | 3 +-
.../DefaultEndUserClaimsLookupStrategy.java | 2 +-
.../navigate/DefaultIDTokenLookupStrategy.java | 2 +-
.../DefaultUserInfoTokenLookupStrategy.java | 4 +-
.../IDTokenInAccessTokenUpdateStrategy.java | 6 +-
.../navigate/IDTokenJOSEHeaderLookupStrategy.java | 2 +-
.../InboundMessageContextFromProxyPRC.java | 2 +-
...viderMetadataFromOuboundPeerLookupStrategy.java | 2 +-
.../OutboundMessageContextFromProxyPRC.java | 3 +-
.../navigate/RawTokenResponseLookupStrategy.java | 5 +-
.../navigate/RequestObjectTokenUpdateStrategy.java | 18 +-
.../navigate/SubFromIDTokenLookupFunction.java | 2 +-
.../TokenResponseIDTokenLookupStrategy.java | 4 +-
...nfoInUserInfoResponseContextUpdateStrategy.java | 4 +-
.../logic => context/navigate}/package-info.java | 4 +-
.../context}/logic/IsCodeFlowPredicate.java | 2 +-
.../context}/logic/IsHybridFlowPredicate.java | 2 +-
.../context}/logic/IsImplicitFlowPredicate.java | 2 +-
.../RequiresSignatureVerificationPredicate.java | 2 +-
.../rp/messaging/context/logic/package-info.java | 2 +-
...WTClaimsSetFromRequestObjectLookupFunction.java | 2 +-
.../PayloadFromRequestObjectLookupFunction.java | 2 +-
...tObjectSupportedSignatureSigningAlgorithms.java | 2 +-
.../context/{logic => navigate}/package-info.java | 4 +-
.../oidc/rp/{config/logic => }/package-info.java | 4 +-
...RequiresSignatureVerificationPredicateTest.java | 17 +
...thenticationContextClassLookupFunctionTest.java | 117 ------
...tionContextClassResponseLookupFunctionTest.java | 124 ------
.../oidc/rp/messaging/JWTUserInfoResponseTest.java | 1 -
.../oidc/rp/config/CredentialsListFactory.java | 66 ----
.../idp/plugin/authn/oidc/rp/impl/DecryptJWT.java | 197 ----------
...nitializeOAuth2ClientAuthenticationContext.java | 52 +--
...RelyingPartyProxySigningParametersResolver.java | 32 +-
...uthenticationContextClassReferencesHandler.java | 2 +-
.../impl/AddResponseTypeAndModeHandler.java | 59 ++-
.../idp/plugin/authn/oidc/rp}/package-info.java | 4 +-
.../META-INF/net.shibboleth.idp/postconfig.xml | 27 +-
.../oidc-relying-party-authn-beans.xml | 48 ++-
.../oidc-relying-party-authn-flow.xml | 4 +-
.../idp/flows/oidc/rp/keyset/keyset-beans.xml | 11 +-
.../idp/service/attribute/registry/postconfig.xml | 27 --
.../idp/service/relying-party/postconfig.xml | 306 +--------------
.../authn/oidc/rp/conf/authn/oidc-claim-rules.xml | 428 ---------------------
.../oidc/rp/conf/authn/oidc-rp-credentials.xml | 35 --
.../authn/oidc/rp/conf/authn/oidc-rp.properties | 9 +-
.../idp/plugin/authn/oidc/rp/module.properties | 14 +-
.../oidc/rp/config/CredentialsListFactoryTest.java | 65 ----
.../authn/oidc/rp/impl/AbstractOIDCTest.java | 6 +-
.../oidc/rp/impl/AuthorizationControllerTest.java | 9 +-
.../plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java | 28 +-
...ingPartyProxySigningParametersResolverTest.java | 36 +-
.../authn/oidc/rp/impl/TestCredentialHelper.java | 31 +-
.../plugin/authn/oidc/rp/impl/TestTokenHelper.java | 16 +-
.../TokenResponseIDTokenLookupStrategyTest.java | 2 +-
.../impl/AddResponseTypeAndModeHandlerTest.java | 37 +-
.../resources/conf/authn/oidc-rp-credentials.xml | 33 --
.../resources/conf/authn/test-oidc-credentials.xml | 48 +++
.../test-relying-party-postconfig.xml} | 347 +++++++++--------
.../conf/test-relyingparty-resolver-service.xml | 4 +-
63 files changed, 543 insertions(+), 2022 deletions(-)
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/logic/package-info.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/logic/package-info.java
index 815438a..9c505b0 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/logic/package-info.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/logic/package-info.java
@@ -16,6 +16,6 @@
*/
/**
- * Package that contains configuration logic
+ * Package that contains predicates related to configuration logic.
*/
package net.shibboleth.idp.plugin.authn.oidc.rp.config.logic;
\ No newline at end of file
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/ProxyAwareDefaultOIDCAuthenticationContextClassRequestLookupFunction.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/ProxyAwareDefaultOIDCAuthenticationContextClassRequestLookupFunction.java
deleted file mode 100644
index b7af435..0000000
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/ProxyAwareDefaultOIDCAuthenticationContextClassRequestLookupFunction.java
+++ /dev/null
@@ -1,114 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate;
-
-import java.security.Principal;
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.Collections;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.idp.authn.context.AuthenticationContext;
-import net.shibboleth.idp.authn.context.RequestedPrincipalContext;
-import net.shibboleth.oidc.authn.principal.AuthenticationContextClassReferencePrincipal;
-import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
-
-/**
- * Implements a set of default logic for determining the custom principals to derive the
- * OIDC ACRs from.
- *
- * <p>This operates for the SAML to OIDC proxy use case. The values returned are empty unless the
- * parent context itself contains a child context carrying particular values. The values are either
- * 'passed through' or mapped by the given principal mappings. All input values are either SAML ACRs or AMRs,
- * and all output values are OIDC ACRs.</p>
- */
-public class ProxyAwareDefaultOIDCAuthenticationContextClassRequestLookupFunction
- implements Function<ProfileRequestContext,Collection<AuthenticationContextClassReferencePrincipal>> {
-
- /** Mappings to transform proxied Principals. */
- @Nonnull @NonnullElements private Map<Principal,Collection<Principal>> principalMappings;
-
- /** Constructor. */
- public ProxyAwareDefaultOIDCAuthenticationContextClassRequestLookupFunction() {
- principalMappings = Collections.emptyMap();
- }
-
- /**
- * Sets the mappings from input/proxied Principals to zero or more equivalent values to use.
- *
- * <p>Any values not mapped will be assumed to be passed through.</p>
- *
- * @param mappings {@link Principal} mappings
- */
- public void setMappings(@Nullable @NonnullElements final Map<Principal,Collection<Principal>> mappings) {
- if (mappings == null || mappings.isEmpty()) {
- principalMappings = Collections.emptyMap();
- return;
- }
-
- principalMappings = new HashMap<>(mappings.size());
- mappings.forEach((k, v) -> principalMappings.put(k, List.copyOf(v)));
- }
-
- @Override
- public Collection<AuthenticationContextClassReferencePrincipal> apply(final ProfileRequestContext input) {
-
- if (input != null && input.getParent() instanceof AuthenticationContext) {
-
- final RequestedPrincipalContext rpc = input.getParent().getSubcontext(RequestedPrincipalContext.class);
-
- if (rpc != null) {
-
- final List<AuthenticationContextClassReferencePrincipal> mappedAndPassedThroughPrincipals =
- new ArrayList<>();
-
- for (final Principal requestedPrincipal : rpc.getRequestedPrincipals()) {
-
- // If a mapping exists, use it
- if (principalMappings.containsKey(requestedPrincipal)) {
- final Collection<Principal> mappedPrinicipals = principalMappings.get(requestedPrincipal);
- for (final Principal mappedPrincipal : mappedPrinicipals) {
- if (mappedPrincipal instanceof AuthenticationContextClassReferencePrincipal) {
- mappedAndPassedThroughPrincipals.add(
- (AuthenticationContextClassReferencePrincipal) mappedPrincipal);
- }
- }
- } else {
- // If no mapping exists, just convert to correct output type - which might not make sense
- // to the upstream OP.
- mappedAndPassedThroughPrincipals.add(
- new AuthenticationContextClassReferencePrincipal(requestedPrincipal.getName()));
- }
-
- }
- return mappedAndPassedThroughPrincipals;
- }
- }
- return Collections.emptyList();
- }
-
-
-}
-
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction.java
deleted file mode 100644
index 7b6860d..0000000
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction.java
+++ /dev/null
@@ -1,115 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate;
-
-import java.security.Principal;
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.Collections;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-import javax.annotation.concurrent.ThreadSafe;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.utilities.java.support.annotation.ParameterName;
-import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-
-/**
- * Implements a set of logic for determining the principals to use from OIDC 'amr' or 'acr' claims.
- *
- * <p>This operates for the OIDC to SAML proxy use case, in effect the reverse of the
- * {@link ProxyAwareDefaultOIDCAuthenticationContextClassRequestLookupFunction} function.
- * All input values are either OIDC ACRs or AMRs, and all output values Java {@link Principal}s.
- * The values are mapped by the given principal mappings. If a mapping does not exist, the AMR or ACR is ignored.
- * </p>
- */
- at ThreadSafe
-public class ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction
- implements Function<Collection<String>,Collection<Principal>> {
-
- /** Mappings to transform proxied Principals. */
- @Nonnull @NonnullElements private final Map<String,Collection<Principal>> principalMappings;
-
- /**
- *
- * Constructor.
- *
- * @param mappings the AMR/ACR value to Principal mappings
- */
- public ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction(
- @Nullable @NonnullElements @ParameterName(name="mappings")
- final Map<String,Collection<Principal>> mappings) {
-
- if (mappings == null || mappings.isEmpty()) {
- principalMappings = Collections.emptyMap();
- } else {
- principalMappings = new HashMap<>(mappings.size());
- mappings.forEach((k, v) -> principalMappings.put(k, List.copyOf(v)));
- }
- }
-
- @Override
- public Collection<Principal> apply(final Collection<String> amrOrAcrs) {
-
- if (amrOrAcrs != null) {
- final List<Principal> principals = new ArrayList<>();
- for (final String amrOrAcr : amrOrAcrs) {
- if (principalMappings.containsKey(amrOrAcr)) {
- final Collection<Principal> mappedPrincipals = principalMappings.get(amrOrAcr);
- if (!mappedPrincipals.isEmpty()) {
- principals.addAll(mappedPrincipals);
- }
- }
- }
- return principals;
- }
- return Collections.emptyList();
- }
-
- /** A simple lookup function that returns a singleton function.*/
- public static class LookupFunctionWrapper
- implements Function<ProfileRequestContext, Function<Collection<String>,Collection<Principal>>> {
-
- /** A function used to map OIDC ACR/AMRs to Principals. A single instance is supplied.*/
- private final Function<Collection<String>,Collection<Principal>> function;
-
- /**
- *
- * Constructor.
- *
- * @param wrappedFunction the function to return when requested.
- */
- public LookupFunctionWrapper(@ParameterName(name="wrappedFunction")
- final Function<Collection<String>,Collection<Principal>> wrappedFunction) {
- function = Constraint.isNotNull(wrappedFunction, "Lookup function can not be null");
- }
-
- @Override
- public Function<Collection<String>, Collection<Principal>> apply(final ProfileRequestContext prc) {
- return function;
- }
-
- }
-}
-
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/AccessTokenResponseContext.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/AccessTokenResponseContext.java
index 4f7956a..3bc8f0f 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/AccessTokenResponseContext.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/AccessTokenResponseContext.java
@@ -23,7 +23,10 @@ import javax.annotation.Nullable;
import com.nimbusds.jwt.JWT;
-/** A context to hold an OIDC token request response.*/
+/**
+ * A context to hold an OIDC token request response. If authenticated, the Token was received over a TLS protected
+ * channel where TLS credential validation was performed and successful.
+ */
public class AccessTokenResponseContext extends AbstractAuthenticatableOIDCContext {
/** The raw token response as a map.*/
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/ClientIDFromOAuth2ClientContextFunction.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/ClientIDFromOAuth2ClientContextFunction.java
similarity index 96%
rename from idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/ClientIDFromOAuth2ClientContextFunction.java
rename to idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/ClientIDFromOAuth2ClientContextFunction.java
index 4edcb4d..4f84a7d 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/ClientIDFromOAuth2ClientContextFunction.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/ClientIDFromOAuth2ClientContextFunction.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate;
+package net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate;
import java.util.function.BiFunction;
import java.util.function.Function;
@@ -35,7 +35,6 @@ import net.shibboleth.utilities.java.support.logic.Constraint;
/**
* A function that pulls the client_id out of the {@link OAuth2ClientContext}.
*/
-//TODO could be moved to commons
@ThreadSafe
public class ClientIDFromOAuth2ClientContextFunction
implements BiFunction<ProfileRequestContext, JWTClaimsSet, String> {
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/DefaultEndUserClaimsLookupStrategy.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/DefaultEndUserClaimsLookupStrategy.java
similarity index 97%
rename from idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/DefaultEndUserClaimsLookupStrategy.java
rename to idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/DefaultEndUserClaimsLookupStrategy.java
index b204019..b7ca409 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/DefaultEndUserClaimsLookupStrategy.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/DefaultEndUserClaimsLookupStrategy.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate;
+package net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate;
import java.util.function.Function;
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/DefaultIDTokenLookupStrategy.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/DefaultIDTokenLookupStrategy.java
similarity index 97%
rename from idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/DefaultIDTokenLookupStrategy.java
rename to idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/DefaultIDTokenLookupStrategy.java
index 69eb757..ccf56ed 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/DefaultIDTokenLookupStrategy.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/DefaultIDTokenLookupStrategy.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate;
+package net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate;
import java.util.function.Function;
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/DefaultUserInfoTokenLookupStrategy.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/DefaultUserInfoTokenLookupStrategy.java
similarity index 95%
rename from idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/DefaultUserInfoTokenLookupStrategy.java
rename to idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/DefaultUserInfoTokenLookupStrategy.java
index e24614f..e19587c 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/DefaultUserInfoTokenLookupStrategy.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/DefaultUserInfoTokenLookupStrategy.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate;
+package net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate;
import java.util.function.Function;
@@ -36,7 +36,7 @@ import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.UserInfoResponse.UserIn
import net.shibboleth.utilities.java.support.logic.Constraint;
/** Function that extracts the id_token from the {@link AccessTokenResponseContext}.*/
-//TODO could this be replaced in the method using it by a ContextDataLookupFunction?
+//TODO could this be replaced by a ContextDataLookupFunction?
@ThreadSafe
public class DefaultUserInfoTokenLookupStrategy implements Function<ProfileRequestContext, JWT> {
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/IDTokenInAccessTokenUpdateStrategy.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/IDTokenInAccessTokenUpdateStrategy.java
similarity index 93%
rename from idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/IDTokenInAccessTokenUpdateStrategy.java
rename to idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/IDTokenInAccessTokenUpdateStrategy.java
index 7803de7..3703e56 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/IDTokenInAccessTokenUpdateStrategy.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/IDTokenInAccessTokenUpdateStrategy.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate;
+package net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate;
import java.util.function.BiConsumer;
import java.util.function.Function;
@@ -34,8 +34,8 @@ import net.shibboleth.idp.plugin.authn.oidc.rp.context.AccessTokenResponseContex
import net.shibboleth.utilities.java.support.annotation.ParameterName;
import net.shibboleth.utilities.java.support.logic.Constraint;
-/** Strategy to update the id_token in the {@link AccessTokenResponseContext}.*/
-public class IDTokenInAccessTokenUpdateStrategy implements BiConsumer<ProfileRequestContext, JWT> {
+/** Consumer to update the id_token in the {@link AccessTokenResponseContext}.*/
+public class IDTokenInAccessTokenUpdateStrategy implements BiConsumer<ProfileRequestContext, JWT> {
/** Class logger. */
@Nonnull private final Logger log = LoggerFactory.getLogger(IDTokenInAccessTokenUpdateStrategy.class);
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/IDTokenJOSEHeaderLookupStrategy.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/IDTokenJOSEHeaderLookupStrategy.java
similarity index 97%
rename from idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/IDTokenJOSEHeaderLookupStrategy.java
rename to idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/IDTokenJOSEHeaderLookupStrategy.java
index 4f129fb..fd5f495 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/IDTokenJOSEHeaderLookupStrategy.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/IDTokenJOSEHeaderLookupStrategy.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate;
+package net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate;
import java.util.function.Function;
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/InboundMessageContextFromProxyPRC.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/InboundMessageContextFromProxyPRC.java
similarity index 97%
rename from idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/InboundMessageContextFromProxyPRC.java
rename to idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/InboundMessageContextFromProxyPRC.java
index ebd79cb..3808ca5 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/InboundMessageContextFromProxyPRC.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/InboundMessageContextFromProxyPRC.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate;
+package net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate;
import javax.annotation.Nullable;
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/OIDCProviderMetadataFromOuboundPeerLookupStrategy.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/OIDCProviderMetadataFromOuboundPeerLookupStrategy.java
similarity index 96%
rename from idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/OIDCProviderMetadataFromOuboundPeerLookupStrategy.java
rename to idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/OIDCProviderMetadataFromOuboundPeerLookupStrategy.java
index 57e74f2..330e015 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/OIDCProviderMetadataFromOuboundPeerLookupStrategy.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/OIDCProviderMetadataFromOuboundPeerLookupStrategy.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate;
+package net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate;
import java.util.function.Function;
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/OutboundMessageContextFromProxyPRC.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/OutboundMessageContextFromProxyPRC.java
similarity index 95%
rename from idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/OutboundMessageContextFromProxyPRC.java
rename to idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/OutboundMessageContextFromProxyPRC.java
index 6c942bc..0f2fc06 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/OutboundMessageContextFromProxyPRC.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/OutboundMessageContextFromProxyPRC.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate;
+package net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate;
import javax.annotation.Nullable;
@@ -32,7 +32,6 @@ import net.shibboleth.idp.authn.context.AuthenticationContext;
public class OutboundMessageContextFromProxyPRC
implements ContextDataLookupFunction<ProfileRequestContext, MessageContext> {
- /** {@inheritDoc} */
@Override
@Nullable
public MessageContext apply(@Nullable final ProfileRequestContext input) {
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/RawTokenResponseLookupStrategy.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/RawTokenResponseLookupStrategy.java
similarity index 93%
rename from idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/RawTokenResponseLookupStrategy.java
rename to idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/RawTokenResponseLookupStrategy.java
index b62c8bd..100318d 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/RawTokenResponseLookupStrategy.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/RawTokenResponseLookupStrategy.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate;
+package net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate;
import java.util.Map;
import java.util.function.Function;
@@ -29,6 +29,7 @@ import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.AccessTokenResponseContext;
+import net.shibboleth.utilities.java.support.annotation.ParameterName;
import net.shibboleth.utilities.java.support.logic.Constraint;
/** Function that extracts the raw token response from the {@link AccessTokenResponseContext}.*/
@@ -52,7 +53,7 @@ public class RawTokenResponseLookupStrategy implements Function<ProfileRequestCo
*
* @param strategy the AccessTokenResponseContext lookup strategy to use.
*/
- public RawTokenResponseLookupStrategy(
+ public RawTokenResponseLookupStrategy(@ParameterName(name = "strategy")
@Nonnull final Function<ProfileRequestContext, AccessTokenResponseContext> strategy) {
tokenResponseContextLookupStrategy =
Constraint.isNotNull(strategy, "AccessTokenResponseContext lookup strategy can not be null");
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/RequestObjectTokenUpdateStrategy.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/RequestObjectTokenUpdateStrategy.java
similarity index 80%
rename from idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/RequestObjectTokenUpdateStrategy.java
rename to idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/RequestObjectTokenUpdateStrategy.java
index 779012f..f7ce4bb 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/RequestObjectTokenUpdateStrategy.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/RequestObjectTokenUpdateStrategy.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate;
+package net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate;
import java.util.function.BiConsumer;
import java.util.function.Function;
@@ -23,14 +23,20 @@ import java.util.function.Function;
import javax.annotation.Nonnull;
import org.opensaml.messaging.context.MessageContext;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
import com.nimbusds.jwt.JWT;
import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
import net.shibboleth.utilities.java.support.logic.Constraint;
-/** Add the {@link JWT} back to the Request Object in the {@link OIDCAuthenticationRequest}.*/
-public class RequestObjectTokenUpdateStrategy implements BiConsumer<JWT, MessageContext> {
+/** Consumer that adds the {@link JWT} back to the Request Object in the {@link OIDCAuthenticationRequest}.*/
+public class RequestObjectTokenUpdateStrategy implements BiConsumer<JWT, MessageContext> {
+
+ /** Class logger. */
+ @Nonnull
+ private final Logger log = LoggerFactory.getLogger(RawTokenResponseLookupStrategy.class);
/** Strategy used to locate the {@link OIDCAuthenticationRequest} to sign. */
@Nonnull private Function<MessageContext, OIDCAuthenticationRequest> authenticationRequestLookupStrategy;
@@ -62,7 +68,11 @@ public class RequestObjectTokenUpdateStrategy implements BiConsumer<JWT, Message
return;
}
final OIDCAuthenticationRequest authnRequest = authenticationRequestLookupStrategy.apply(messageContext);
- authnRequest.setRequestObject(jwt);
+ if (authnRequest != null) {
+ authnRequest.setRequestObject(jwt);
+ } else {
+ log.warn("Unable to set JWT on OIDC authentication request, request was null");
+ }
}
}
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/SubFromIDTokenLookupFunction.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/SubFromIDTokenLookupFunction.java
similarity index 98%
rename from idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/SubFromIDTokenLookupFunction.java
rename to idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/SubFromIDTokenLookupFunction.java
index 5642cca..e4a1d95 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/SubFromIDTokenLookupFunction.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/SubFromIDTokenLookupFunction.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate;
+package net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate;
import java.text.ParseException;
import java.util.function.BiFunction;
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/TokenResponseIDTokenLookupStrategy.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/TokenResponseIDTokenLookupStrategy.java
similarity index 96%
rename from idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/TokenResponseIDTokenLookupStrategy.java
rename to idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/TokenResponseIDTokenLookupStrategy.java
index cd35f3f..0cfba49 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/TokenResponseIDTokenLookupStrategy.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/TokenResponseIDTokenLookupStrategy.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate;
+package net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate;
import java.util.function.Function;
@@ -29,7 +29,7 @@ import org.slf4j.LoggerFactory;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.AccessTokenResponseContext;
-/** Return the raw base64 encoded id_token from the TokenResponseContext, or null if not found.*/
+/** Return the raw base64 encoded id_token from the TokenResponseContext, or {@code null} if not found.*/
public class TokenResponseIDTokenLookupStrategy implements Function<ProfileRequestContext, String> {
/** Class logger. */
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/UserInfoInUserInfoResponseContextUpdateStrategy.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/UserInfoInUserInfoResponseContextUpdateStrategy.java
similarity index 95%
rename from idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/UserInfoInUserInfoResponseContextUpdateStrategy.java
rename to idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/UserInfoInUserInfoResponseContextUpdateStrategy.java
index 3541557..d375bb1 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/UserInfoInUserInfoResponseContextUpdateStrategy.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/UserInfoInUserInfoResponseContextUpdateStrategy.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate;
+package net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate;
import java.util.function.BiConsumer;
import java.util.function.Function;
@@ -38,7 +38,7 @@ import net.shibboleth.utilities.java.support.annotation.ParameterName;
import net.shibboleth.utilities.java.support.logic.Constraint;
/**
- * Strategy to update the UserInfo JWT in the {@link UserInfoResponseContext}.
+ * Consumer strategy to update the UserInfo JWT in the {@link UserInfoResponseContext}.
* Note, replaces the entire {@link UserInfoResponse} object.
*/
public class UserInfoInUserInfoResponseContextUpdateStrategy implements BiConsumer<ProfileRequestContext, JWT> {
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/logic/package-info.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/package-info.java
similarity index 88%
copy from idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/logic/package-info.java
copy to idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/package-info.java
index 815438a..843f696 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/logic/package-info.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/navigate/package-info.java
@@ -16,6 +16,6 @@
*/
/**
- * Package that contains configuration logic
+ * Functions to navigate profile contexts.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.config.logic;
\ No newline at end of file
+package net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate;
\ No newline at end of file
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/logic/IsCodeFlowPredicate.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/IsCodeFlowPredicate.java
similarity index 96%
rename from idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/logic/IsCodeFlowPredicate.java
rename to idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/IsCodeFlowPredicate.java
index 72d2295..bf588c4 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/logic/IsCodeFlowPredicate.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/IsCodeFlowPredicate.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.config.logic;
+package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic;
import java.util.function.Predicate;
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/logic/IsHybridFlowPredicate.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/IsHybridFlowPredicate.java
similarity index 96%
rename from idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/logic/IsHybridFlowPredicate.java
rename to idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/IsHybridFlowPredicate.java
index d43b0ec..86f304d 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/logic/IsHybridFlowPredicate.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/IsHybridFlowPredicate.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.config.logic;
+package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic;
import java.util.function.Predicate;
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/logic/IsImplicitFlowPredicate.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/IsImplicitFlowPredicate.java
similarity index 96%
rename from idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/logic/IsImplicitFlowPredicate.java
rename to idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/IsImplicitFlowPredicate.java
index ed40d87..ff5ee61 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/logic/IsImplicitFlowPredicate.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/IsImplicitFlowPredicate.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.config.logic;
+package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic;
import java.util.function.Predicate;
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/logic/RequiresSignatureVerificationPredicate.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/RequiresSignatureVerificationPredicate.java
similarity index 98%
rename from idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/logic/RequiresSignatureVerificationPredicate.java
rename to idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/RequiresSignatureVerificationPredicate.java
index 2ed85a8..7c11855 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/logic/RequiresSignatureVerificationPredicate.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/RequiresSignatureVerificationPredicate.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.config.logic;
+package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic;
import java.util.function.Function;
import java.util.function.Predicate;
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/package-info.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/package-info.java
index 3b6bee2..81c17fe 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/package-info.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/package-info.java
@@ -16,6 +16,6 @@
*/
/**
- * Configuration navigation for RP-specific messaging configuration.
+ * Predicates for RP-specific messaging configuration.
*/
package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic;
\ No newline at end of file
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/JWTClaimsSetFromRequestObjectLookupFunction.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/navigate/JWTClaimsSetFromRequestObjectLookupFunction.java
similarity index 99%
rename from idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/JWTClaimsSetFromRequestObjectLookupFunction.java
rename to idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/navigate/JWTClaimsSetFromRequestObjectLookupFunction.java
index 86bcd3f..b16dba8 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/JWTClaimsSetFromRequestObjectLookupFunction.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/navigate/JWTClaimsSetFromRequestObjectLookupFunction.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic;
+package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.navigate;
import java.text.ParseException;
import java.util.function.Function;
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/PayloadFromRequestObjectLookupFunction.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/navigate/PayloadFromRequestObjectLookupFunction.java
similarity index 99%
rename from idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/PayloadFromRequestObjectLookupFunction.java
rename to idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/navigate/PayloadFromRequestObjectLookupFunction.java
index afe7a10..c197ba8 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/PayloadFromRequestObjectLookupFunction.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/navigate/PayloadFromRequestObjectLookupFunction.java
@@ -16,7 +16,7 @@
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic;
+package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.navigate;
import java.text.ParseException;
import java.util.function.Function;
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/RequestObjectSupportedSignatureSigningAlgorithms.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/navigate/RequestObjectSupportedSignatureSigningAlgorithms.java
similarity index 99%
rename from idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/RequestObjectSupportedSignatureSigningAlgorithms.java
rename to idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/navigate/RequestObjectSupportedSignatureSigningAlgorithms.java
index df4675b..f8e8c09 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/RequestObjectSupportedSignatureSigningAlgorithms.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/navigate/RequestObjectSupportedSignatureSigningAlgorithms.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic;
+package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.navigate;
import java.util.List;
import java.util.function.Function;
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/package-info.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/navigate/package-info.java
similarity index 92%
copy from idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/package-info.java
copy to idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/navigate/package-info.java
index 3b6bee2..525cfbb 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/package-info.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/navigate/package-info.java
@@ -16,6 +16,6 @@
*/
/**
- * Configuration navigation for RP-specific messaging configuration.
+ * Functions that navigate messaging contexts.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic;
\ No newline at end of file
+package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.navigate;
\ No newline at end of file
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/logic/package-info.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/package-info.java
similarity index 88%
copy from idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/logic/package-info.java
copy to idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/package-info.java
index 815438a..056123a 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/logic/package-info.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/package-info.java
@@ -16,6 +16,6 @@
*/
/**
- * Package that contains configuration logic
+ * Shibboleth relying-party proxy API.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.config.logic;
\ No newline at end of file
+package net.shibboleth.idp.plugin.authn.oidc.rp;
\ No newline at end of file
diff --git a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/logic/RequiresSignatureVerificationPredicateTest.java b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/logic/RequiresSignatureVerificationPredicateTest.java
index 7776f73..0ad6f0b 100644
--- a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/logic/RequiresSignatureVerificationPredicateTest.java
+++ b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/logic/RequiresSignatureVerificationPredicateTest.java
@@ -1,3 +1,19 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
package net.shibboleth.idp.plugin.authn.oidc.rp.config.logic;
@@ -8,6 +24,7 @@ import org.opensaml.messaging.context.MessageContext;
import org.testng.annotations.Test;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.AbstractAuthenticatableOIDCContext;
+import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic.RequiresSignatureVerificationPredicate;
public class RequiresSignatureVerificationPredicateTest {
diff --git a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/ProxyAwareDefaultOIDCAuthenticationContextClassLookupFunctionTest.java b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/ProxyAwareDefaultOIDCAuthenticationContextClassLookupFunctionTest.java
deleted file mode 100644
index dced1f6..0000000
--- a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/ProxyAwareDefaultOIDCAuthenticationContextClassLookupFunctionTest.java
+++ /dev/null
@@ -1,117 +0,0 @@
-package net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate;
-
-import static org.testng.Assert.assertTrue;
-
-import java.security.Principal;
-import java.util.Collection;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Test;
-
-import net.shibboleth.idp.authn.context.AuthenticationContext;
-import net.shibboleth.idp.authn.context.RequestedPrincipalContext;
-import net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal;
-import net.shibboleth.oidc.authn.principal.AuthenticationContextClassReferencePrincipal;
-
-/** Tests for ProxyAwareDefaultOIDCAuthenticationContextClassLookupFunction.*/
-public class ProxyAwareDefaultOIDCAuthenticationContextClassLookupFunctionTest {
-
- private ProxyAwareDefaultOIDCAuthenticationContextClassRequestLookupFunction function;
-
- private ProfileRequestContext prc;
-
- private ProfileRequestContext nestedPrc;
-
- private AuthenticationContext ac;
-
- private RequestedPrincipalContext rpc;
-
- @BeforeMethod
- public void setup() {
- function = new ProxyAwareDefaultOIDCAuthenticationContextClassRequestLookupFunction();
- prc = new ProfileRequestContext();
- ac = prc.getSubcontext(AuthenticationContext.class, true);
- nestedPrc = ac.getSubcontext(ProfileRequestContext.class, true);
- rpc = ac.getSubcontext(RequestedPrincipalContext.class, true);
- }
-
- @Test
- public void testSingleMappingSuccess() {
-
-
- final List<Principal> requestedPrincipals =
- List.of(new AuthnContextClassRefPrincipal("http://example.org/ac/classes/mfa"));
- rpc.setRequestedPrincipals(requestedPrincipals);
- rpc.setOperator("exact");
-
- final Map<Principal,Collection<Principal>> mappings = new HashMap<>();
- mappings.put(new AuthnContextClassRefPrincipal("http://example.org/ac/classes/mfa"),
- List.of(new AuthenticationContextClassReferencePrincipal("http://proxy.example.org/ac/classes/mfa")));
- function.setMappings(mappings);
-
- final Collection<AuthenticationContextClassReferencePrincipal> mapped = function.apply(nestedPrc);
- System.out.println(mapped);
- assertTrue(mapped.contains(
- new AuthenticationContextClassReferencePrincipal("http://proxy.example.org/ac/classes/mfa")));
-
- }
-
- @Test
- public void testMappedAndPassedThroughSuccess() {
-
-
- // The second principal is passed-through as no mapping exists
- final List<Principal> requestedPrincipals =
- List.of(new AuthnContextClassRefPrincipal("http://example.org/ac/classes/mfa"),
- new AuthnContextClassRefPrincipal("http://example.org/ac/classes/pass-through"));
- rpc.setRequestedPrincipals(requestedPrincipals);
- rpc.setOperator("exact");
-
- final Map<Principal,Collection<Principal>> mappings = new HashMap<>();
- mappings.put(new AuthnContextClassRefPrincipal("http://example.org/ac/classes/mfa"),
- List.of(new AuthenticationContextClassReferencePrincipal("http://proxy.example.org/ac/classes/mfa")));
- function.setMappings(mappings);
-
- final Collection<AuthenticationContextClassReferencePrincipal> mapped = function.apply(nestedPrc);
- System.out.println(mapped);
- assertTrue(mapped.contains(
- new AuthenticationContextClassReferencePrincipal("http://proxy.example.org/ac/classes/mfa")));
- assertTrue(mapped.contains(
- new AuthenticationContextClassReferencePrincipal("http://example.org/ac/classes/pass-through")));
-
- }
-
- @Test
- public void testMultipleMappedAndPassedThroughSuccess() {
-
-
- // The second principal is passed-through as no mapping exists
- final List<Principal> requestedPrincipals =
- List.of(new AuthnContextClassRefPrincipal("http://example.org/ac/classes/mfa"),
- new AuthnContextClassRefPrincipal("http://example.org/ac/classes/pass-through"));
- rpc.setRequestedPrincipals(requestedPrincipals);
- rpc.setOperator("exact");
-
- final Map<Principal,Collection<Principal>> mappings = new HashMap<>();
- mappings.put(new AuthnContextClassRefPrincipal("http://example.org/ac/classes/mfa"),
- List.of(new AuthenticationContextClassReferencePrincipal("http://proxy.example.org/ac/classes/mfa"),
- new AuthenticationContextClassReferencePrincipal(
- "http://proxy.two.example.org/ac/classes/mfa")));
- function.setMappings(mappings);
-
- final Collection<AuthenticationContextClassReferencePrincipal> mapped = function.apply(nestedPrc);
- System.out.println(mapped);
- assertTrue(mapped.contains(
- new AuthenticationContextClassReferencePrincipal("http://proxy.example.org/ac/classes/mfa")));
- assertTrue(mapped.contains(
- new AuthenticationContextClassReferencePrincipal("http://proxy.two.example.org/ac/classes/mfa")));
- assertTrue(mapped.contains(
- new AuthenticationContextClassReferencePrincipal("http://example.org/ac/classes/pass-through")));
-
- }
-
-}
diff --git a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunctionTest.java b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunctionTest.java
deleted file mode 100644
index 8e3cac7..0000000
--- a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunctionTest.java
+++ /dev/null
@@ -1,124 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate;
-
-import static org.testng.Assert.assertEquals;
-import static org.testng.Assert.assertTrue;
-
-import java.security.Principal;
-import java.util.Collection;
-import java.util.Collections;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Test;
-
-import net.shibboleth.idp.authn.context.AuthenticationContext;
-import net.shibboleth.idp.authn.context.RequestedPrincipalContext;
-import net.shibboleth.idp.saml.authn.principal.AuthenticationMethodPrincipal;
-
-/** Tests for ProxyAwareDefaultOIDCAuthenticationContextClassLookupFunction.*/
-public class ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunctionTest {
-
- private ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction function;
-
- private ProfileRequestContext prc;
-
- private ProfileRequestContext nestedPrc;
-
- private AuthenticationContext ac;
-
- private RequestedPrincipalContext rpc;
-
- @BeforeMethod
- public void setup() {
- prc = new ProfileRequestContext();
- ac = prc.getSubcontext(AuthenticationContext.class, true);
- nestedPrc = ac.getSubcontext(ProfileRequestContext.class, true);
- rpc = ac.getSubcontext(RequestedPrincipalContext.class, true);
- }
-
- @Test
- public void testSingleMappingSuccess() {
-
- final Map<String,Collection<Principal>> mappings = new HashMap<>();
- mappings.put(
- "pwd",
- List.of(new AuthenticationMethodPrincipal("urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport")));
-
- function = new ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction(mappings);
-
- final Collection<Principal> mapped = function.apply(List.of("pwd"));
- assertTrue(mapped.contains(
- new AuthenticationMethodPrincipal("urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport")));
-
- }
-
- @Test
- public void testSingleMappingSuccess_NotMappedIgnored() {
-
-
- final Map<String,Collection<Principal>> mappings = new HashMap<>();
- mappings.put(
- "pwd",
- List.of(new AuthenticationMethodPrincipal("urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport")));
- function = new ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction(mappings);;
-
- // OTP should not be in the result
- final Collection<Principal> mapped = function.apply(List.of("pwd","otp"));
- assertEquals(mapped.size(), 1);
- assertTrue(mapped.contains(
- new AuthenticationMethodPrincipal("urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport")));
-
- }
-
- @Test
- public void testSingleMappingSuccess_EmptyInput() {
-
- // OTP should not be in the result
- final Collection<Principal> mapped = function.apply(Collections.emptyList());
- assertEquals(mapped.size(), 0);
- }
-
- @Test
- public void testSingleMappingSuccess_NullMappings() {
-
- function = new ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction(null);
-
- // OTP should not be in the result
- final Collection<Principal> mapped = function.apply(Collections.emptyList());
- assertEquals(mapped.size(), 0);
- }
-
- @Test
- public void testSingleMappingSuccess_EmptyMapping() {
-
- final Map<String,Collection<Principal>> mappings = new HashMap<>();
- mappings.put("pwd", Collections.emptyList());
- function = new ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction(mappings);
-
- // OTP should not be in the result
- final Collection<Principal> mapped = function.apply(Collections.emptyList());
- assertEquals(mapped.size(), 0);
- }
-
-
-}
diff --git a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/JWTUserInfoResponseTest.java b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/JWTUserInfoResponseTest.java
index a059a72..db68812 100644
--- a/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/JWTUserInfoResponseTest.java
+++ b/idp-oidc-rp-api/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/JWTUserInfoResponseTest.java
@@ -15,7 +15,6 @@
* limitations under the License.
*/
-
package net.shibboleth.idp.plugin.authn.oidc.rp.messaging;
import static org.testng.Assert.assertEquals;
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/CredentialsListFactory.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/CredentialsListFactory.java
deleted file mode 100644
index 04a40b6..0000000
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/CredentialsListFactory.java
+++ /dev/null
@@ -1,66 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.authn.oidc.rp.config;
-
-import java.util.Collections;
-import java.util.List;
-import java.util.Objects;
-import java.util.stream.Collectors;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.security.credential.Credential;
-import org.opensaml.xmlsec.impl.BasicSignatureSigningConfiguration;
-import org.springframework.beans.factory.config.AbstractFactoryBean;
-
-/**
- * A factory that returns a list of credentials which does not contain any {@literal null} elements.
- *
- * <p>Primarily created to support signature credential injection into the {@link BasicSignatureSigningConfiguration} sdrfgrfgergerg
- * when the credential list may contain, in its raw state, {@literal null} elements.</p>
- */
-public class CredentialsListFactory extends AbstractFactoryBean<List<Credential>> {
-
- /** The credentials which may contain {@literal null} elements. */
- @Nonnull private List<Credential> credentials;
-
- /**
- * Constructor.
- *
- * @param creds the credentials, which can be {@literal null} and may contain {@literal null} elements.
- */
- public CredentialsListFactory(@Nullable final List<Credential> creds){
- if (creds == null) {
- credentials = Collections.emptyList();
- } else {
- credentials = creds;
- }
- }
-
- @Override
- public Class<?> getObjectType() {
- return List.class;
- }
-
- @Override
- protected List<Credential> createInstance() throws Exception {
- return credentials.stream().filter(Objects::nonNull).collect(Collectors.toList());
- }
-
-}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/DecryptJWT.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/DecryptJWT.java
deleted file mode 100644
index c791799..0000000
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/DecryptJWT.java
+++ /dev/null
@@ -1,197 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
-
-import java.text.ParseException;
-import java.util.function.BiConsumer;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
-import org.opensaml.profile.action.ActionSupport;
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
-import org.opensaml.xmlsec.encryption.support.DecryptionException;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import com.nimbusds.jwt.EncryptedJWT;
-import com.nimbusds.jwt.JWT;
-
-import net.shibboleth.idp.profile.AbstractProfileAction;
-import net.shibboleth.oidc.profile.core.OidcEventIds;
-import net.shibboleth.oidc.security.impl.OIDCTokenDecrypter;
-import net.shibboleth.oidc.security.jose.DecryptionParameters;
-import net.shibboleth.oidc.security.jose.context.SecurityParametersContext;
-import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-import net.shibboleth.utilities.java.support.component.ComponentSupport;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-
-/**
- * Decrypt the located JWE using the decryption parameters stored in the security context.
- *
- * @event {@link org.opensaml.profile.action.EventIds#PROCEED_EVENT_ID}
- * @event {@link EventIds#INVALID_SEC_CFG}
- * @event {@link OidcEventIds#INVALID_ID_TOKEN}
- * @post Decrypt a JWT and add it back to via an update strategy.
- */
-public class DecryptJWT extends AbstractProfileAction {
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(DecryptJWT.class);
-
- /** Function that looks up a signed JWT token from the given message context to validate.*/
- @NonnullAfterInit private Function<ProfileRequestContext, EncryptedJWT> jwtTokenLookupStrategy;
-
- /**
- * A consumer that sets the JWT produced from this decryption operation back into the profile request context.
- */
- @NonnullAfterInit private BiConsumer<ProfileRequestContext, JWT> jwtUpdateStrategy;
-
- /** The extracted encrypted JWT that is to be validated.*/
- @Nullable private EncryptedJWT encryptedJwt;
-
- /** The decryption object. */
- @Nullable private OIDCTokenDecrypter decrypter;
-
- /** Strategy used to locate the {@link SecurityParametersContext}. */
- @Nonnull private Function<ProfileRequestContext, SecurityParametersContext> securityParamsLookupStrategy;
-
- /** Constructor.*/
- public DecryptJWT() {
- securityParamsLookupStrategy =
- new ChildContextLookup<>(SecurityParametersContext.class).compose(
- new InboundMessageContextLookup());
- }
-
- /**
- * Set the strategy used to locate the {@link SecurityParametersContext} associated with a given
- * {@link ProfileRequestContext}.
- *
- * @param strategy strategy used to locate the {@link SecurityParametersContext} associated with a given
- * {@link ProfileRequestContext}
- */
- public void setSecurityParametersContextLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, SecurityParametersContext> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- securityParamsLookupStrategy =
- Constraint.isNotNull(strategy, "SecurityParametersContext lookup strategy cannot be null");
- }
-
- /**
- * Set the strategy used to update the profile request context with the JWT produced as a result
- * of this decryption operation.
- *
- * @param strategy the strategy
- */
- public void setJwtUpdateStrategy(@Nonnull final BiConsumer<ProfileRequestContext, JWT> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- jwtUpdateStrategy = Constraint.isNotNull(strategy, "JWT update stategy can not be null");
- }
-
- /**
- * Set the strategy used to look up a {@link EncryptedJWT encrypted JWT token}.
- *
- * @param strategy lookup strategy
- */
- public void setJwtTokenLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, EncryptedJWT> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- jwtTokenLookupStrategy = Constraint.isNotNull(strategy,
- "JwtToken lookup strategy cannot be null");
- }
-
- @Override
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
-
- if (jwtTokenLookupStrategy == null) {
- throw new ComponentInitializationException("JWTTokenLookupStrategy cannot be null");
- }
- if (jwtUpdateStrategy == null) {
- throw new ComponentInitializationException("JWTUpdateStrategy cannot be null");
- }
- }
-
- /** {@inheritDoc} */
- @Override
- protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- if (!super.doPreExecute(profileRequestContext)) {
- return false;
- }
-
- encryptedJwt = jwtTokenLookupStrategy.apply(profileRequestContext);
- if (encryptedJwt == null) {
- log.debug("{} JWT was not encrypted, nothing to decrypt",
- getLogPrefix());
- return false;
- }
-
- final SecurityParametersContext paramsCtx = securityParamsLookupStrategy.apply(profileRequestContext);
- if (paramsCtx == null || paramsCtx.getDecryptionParameters() == null) {
- log.debug("{} No security parameter context or decryption parameters", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_SEC_CFG);
- return false;
- } else {
- final DecryptionParameters params = paramsCtx.getDecryptionParameters();
- decrypter = new OIDCTokenDecrypter(params);
- }
-
-
- return true;
- }
-
- @Override
- protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
-
- log.debug("{} Decrypting encrypted JWT", getLogPrefix());
- try {
- final JWT decryptedJWT = decrypter.decrypt(encryptedJwt);
- log.debug("{} JWT decrypted successfully", getLogPrefix());
- if (log.isTraceEnabled()) {
- logJWT(decryptedJWT);
- }
- jwtUpdateStrategy.accept(profileRequestContext, decryptedJWT);
- } catch (final DecryptionException e) {
- log.error("{} Unable to decrypt JWT", getLogPrefix(), e);
- ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_ID_TOKEN);
- return;
- }
- }
-
- /**
- * Log (on trace) the JWT.
- *
- * @param jwt the JWT to log.
- */
- private void logJWT(@Nonnull final JWT jwt) {
- try {
- log.trace("{} Decrypted JWT: {}", getLogPrefix(), jwt.getJWTClaimsSet().toString());
- } catch (final IllegalStateException | ParseException e) {
- log.trace("{} Unable to print decrypted JWT: {}", getLogPrefix(), e.getMessage());
- }
- }
-
-}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationContext.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationContext.java
index 1a1d2c0..6dfe0d0 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationContext.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationContext.java
@@ -18,10 +18,6 @@
package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
import java.nio.charset.StandardCharsets;
-import java.time.Duration;
-import java.time.Instant;
-import java.util.Date;
-import java.util.Set;
import java.util.function.Function;
import javax.annotation.Nonnull;
@@ -33,7 +29,6 @@ import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.OutboundMessageContextLookup;
-import org.opensaml.security.credential.Credential;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -50,7 +45,7 @@ import net.shibboleth.idp.profile.IdPEventIds;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.oidc.authn.context.OAuth2ClientAuthenticationContext;
import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
-import net.shibboleth.oidc.security.credential.ExpiringJWKCredential;
+import net.shibboleth.oidc.security.credential.ClientSecretCredential;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
@@ -170,19 +165,14 @@ public class InitializeOAuth2ClientAuthenticationContext extends AbstractProfile
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
super.doExecute(profileRequestContext);
- final Set<String> clientAuthMethods =
- profileConfiguration.getTokenEndpointAuthMethods(profileRequestContext);
- if (clientAuthMethods.isEmpty()) {
+ final String clientAuthMethod =
+ profileConfiguration.getTokenEndpointAuthMethod(profileRequestContext);
+ if (clientAuthMethod.isEmpty()) {
log.error("{} No client authentication method found from profile configuration", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_RELYING_PARTY_CONFIG);
return;
}
- if (clientAuthMethods.size() > 1) {
- log.error("{} Must specify only one client authentication mode", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_RELYING_PARTY_CONFIG);
- return;
- }
-
+
final String clientId =
profileConfiguration.getClientId(profileRequestContext);
if (clientId == null) {
@@ -191,16 +181,16 @@ public class InitializeOAuth2ClientAuthenticationContext extends AbstractProfile
return;
}
- final Credential clientCredential =
+ final ClientSecretCredential clientCredential =
profileConfiguration.getClientCredential(profileRequestContext);
if (clientCredential == null) {
- log.error("{} No client credential found from profile configuration", getLogPrefix());
+ log.error("{} No client secret credential found from profile configuration", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_RELYING_PARTY_CONFIG);
return;
}
final ClientAuthentication clientAuthentication =
- constructClientAuthentication(clientId, clientAuthMethods.iterator().next(), clientCredential);
+ constructClientAuthentication(clientId, clientAuthMethod, clientCredential);
if (clientAuthentication == null) {
log.error("{} No client authentication could be constructed", getLogPrefix());
@@ -225,30 +215,12 @@ public class InitializeOAuth2ClientAuthenticationContext extends AbstractProfile
*/
@Nullable protected ClientAuthentication constructClientAuthentication(
@Nonnull final String clientId, @Nonnull final String tokenEndpointAuthMethod,
- @Nonnull final Credential clientCredential) {
-
- // TODO support JWT types
-
- if (clientCredential.getSecretKey() == null) {
- log.warn("{} Client credential is not a symmetric key, only client_secret methods currently supported "
- + "to construct client authentication",getLogPrefix());
- return null;
- }
- Duration secretExpiresAt = Duration.ZERO;
- if (clientCredential instanceof ExpiringJWKCredential) {
- secretExpiresAt = ((ExpiringJWKCredential)clientCredential).getCredentialExpiresAt();
- }
+ @Nonnull final ClientSecretCredential clientCredential) {
- final String secretKeyConverted = convertSecretKeyToString(clientCredential.getSecretKey());
- if (secretKeyConverted == null) {
- log.warn("{} Secret key is null, unable to construct client authentication",getLogPrefix());
- return null;
- }
- final Secret secret = secretExpiresAt.toSeconds() == 0 ?
- new Secret(secretKeyConverted) :
- new Secret(secretKeyConverted, Date.from(Instant.ofEpochSecond(secretExpiresAt.toSeconds())));
+ // TODO support JWT types
+ final Secret secret = new Secret(clientCredential.getSecret());
-
+ // TODO redundent check for now, as the secret can not expire. Add back?
if (secret.expired()) {
log.warn("{} Client secret has expired for client '{}'", getLogPrefix(), clientId);
return null;
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/RelyingPartyProxySigningParametersResolver.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/RelyingPartyProxySigningParametersResolver.java
index cd0ba2c..486aac6 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/RelyingPartyProxySigningParametersResolver.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/RelyingPartyProxySigningParametersResolver.java
@@ -37,10 +37,11 @@ import com.nimbusds.jose.JWSAlgorithm;
import com.nimbusds.jose.jwk.Curve;
import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
-import net.shibboleth.oidc.security.impl.CredentialConversionUtil;
+import net.shibboleth.oidc.security.CredentialConversionUtil;
+import net.shibboleth.oidc.security.credential.ClientSecretCredential;
import net.shibboleth.oidc.security.jose.SignatureSigningParameters;
+import net.shibboleth.oidc.security.jose.criterion.ClientSecretCredentialCriterion;
import net.shibboleth.oidc.security.jose.criterion.ProviderMetadataCriterion;
-import net.shibboleth.oidc.security.jose.criterion.StaticCredentialCriterion;
import net.shibboleth.oidc.security.jose.impl.BasicSignatureSigningParametersResolver;
import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.logic.FunctionSupport;
@@ -48,8 +49,8 @@ import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
/**
* A specialization of {@link BasicSignatureSigningParametersResolver} which supports selecting signing credentials
- * from static credential criterion (e.g. from the reyling party configuration) in addition to the configured signing
- * credentials inside the signing configuration (determined by the superclass).
+ * from client secret credential criterion (e.g. from the reyling party configuration) in addition to the configured
+ * signing credentials inside the signing configuration (determined by the superclass).
*
* <p>The upstream OP's metadata is also used to filter for those algorithms supported by the OP in addition to
* those supported by the security configuration.</p>
@@ -59,7 +60,7 @@ import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
* {@link JWTBasicSignatureSigningParametersResolver}, the following inputs are also supported:
* </p>
* <ul>
- * <li>{@link StaticCredentialCriterion} - optional</li>
+ * <li>{@link ClientSecretCredentialCriterion} - optional</li>
* <li>{@link ProviderMetadataCriterion} - required</li>
* </ul>
*/
@@ -71,7 +72,7 @@ public class RelyingPartyProxySigningParametersResolver extends BasicSignatureSi
/**
* A strategy to pull out the correct set of supported algorithms from the {@link OIDCProviderMetadata}.
- * By default returns {@literal null} signalling 'do not filter'.
+ * By default returns {@literal null}, signalling 'do not filter'.
*/
@Nonnull private Function<OIDCProviderMetadata, List<String>> providerMetadataAlgorithmLookupStrategy;
@@ -102,10 +103,13 @@ public class RelyingPartyProxySigningParametersResolver extends BasicSignatureSi
final List<Credential> allCredentials = new ArrayList<>();
// Add any static credentials from the criteria
- if (criteria.contains(StaticCredentialCriterion.class)) {
- final Credential staticCred = criteria.get(StaticCredentialCriterion.class).getCredential();
- log.trace("Signing credential found in criterion '{}'", staticCred.getKeyNames());
- allCredentials.add(staticCred);
+ if (criteria.contains(ClientSecretCredentialCriterion.class)) {
+ final ClientSecretCredential staticCred =
+ criteria.get(ClientSecretCredentialCriterion.class).getCredential();
+
+ log.trace("Client Secret signing credential found in criterion");
+ // Extract a key suitable for creating and validating MACs
+ allCredentials.add(staticCred.toSigningCredential());
}
// Add any credentials from the configuration
@@ -134,7 +138,11 @@ public class RelyingPartyProxySigningParametersResolver extends BasicSignatureSi
params.setSignatureAlgorithm(foundSupportedAlgorithm.getName());
return;
}
- log.trace("Credential failed eval against Signing Algorithm");
+ if (log.isTraceEnabled()) {
+ log.trace("Credential '{}' failed eval against Signing Algorithm '{}'",
+ CredentialConversionUtil.resolveKid(credential), algorithm);
+
+ }
}
}
}
@@ -198,7 +206,7 @@ public class RelyingPartyProxySigningParametersResolver extends BasicSignatureSi
}
/**
- * Filter the set of algorithms against the set supported by the upstream OP.
+ * Filter the set of algorithms against the set supported by the OpenID Provider.
* Always returns a new list reference. The ordering of the input algorithms should be preserved.
*
* @param criteria the criteria to extract the OP's metadata from to check supported algorithms.
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddAuthenticationContextClassReferencesHandler.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddAuthenticationContextClassReferencesHandler.java
index bf8a893..228ae6b 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddAuthenticationContextClassReferencesHandler.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddAuthenticationContextClassReferencesHandler.java
@@ -32,8 +32,8 @@ import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.claims.ACR;
-import net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassRequestLookupFunction;
import net.shibboleth.oidc.authn.principal.AuthenticationContextClassReferencePrincipal;
+import net.shibboleth.oidc.profile.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassRequestLookupFunction;
/**
* A message handler that adds any authentication context class references from the those derived from the
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddResponseTypeAndModeHandler.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddResponseTypeAndModeHandler.java
index 193f723..b5cf183 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddResponseTypeAndModeHandler.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddResponseTypeAndModeHandler.java
@@ -17,6 +17,9 @@
package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl;
+import java.util.ArrayList;
+import java.util.List;
+
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
@@ -52,12 +55,17 @@ public class AddResponseTypeAndModeHandler extends AbstractOIDCAuthenticationReq
if (responseType == null){
throw new MessageHandlerException("response_type '"+responseTypeFromProfile+"' is not supported");
}
+ // Check is supported by the provider
+ checkProviderSupportsResponseType(responseType);
final String responseModeFromProfile =
getProfileConfiguration().getResponseMode(lookupProfileRequestContext(messageContext));
final ResponseMode responseModeOverride = parseResponseMode(responseModeFromProfile);
final ResponseMode compatibleMode = ResponseMode.resolve(null, responseType);
+
+ checkProviderSupportsResponseMode(compatibleMode);
+
log.trace("{} Compatible response_mode '{}' resolved from response_type '{}'", getLogPrefix(), compatibleMode,
responseTypeFromProfile);
getAuthenticationRequest().setDefaultResponseMode(compatibleMode);
@@ -65,7 +73,9 @@ public class AddResponseTypeAndModeHandler extends AbstractOIDCAuthenticationReq
if (responseModeOverride != null && !responseModeOverride.equals(compatibleMode)) {
log.debug("{} response_mode override '{}' exists in the profile configuration and is different than the"
+ " default mode '{}' for response_type '{}'",
- getLogPrefix(), responseModeFromProfile, compatibleMode, responseType);
+ getLogPrefix(), responseModeFromProfile, compatibleMode, responseType);
+
+ checkProviderSupportsResponseMode(responseModeOverride);
getAuthenticationRequest().setResponseMode(responseModeOverride);
} else {
@@ -78,6 +88,53 @@ public class AddResponseTypeAndModeHandler extends AbstractOIDCAuthenticationReq
}
+ /**
+ * Check the OpenID Provider supports the response_type from its metadata value response_types_supported. Throws
+ * an exception if not.
+ *
+ * @param responseType the response_type to check is supported
+ *
+ * @throws MessageHandlerException if the OpenID Provider does not support the response_type
+ */
+ private void checkProviderSupportsResponseType(@Nonnull final ResponseType responseType)
+ throws MessageHandlerException {
+ final List<ResponseType> responseTypesSupported = getProviderMetadata().getResponseTypes();
+ if (responseTypesSupported == null) {
+ throw new MessageHandlerException("OpenID Provider has not specified supported response types "
+ + "(response_types_supported). It MUST.");
+ }
+ if (!responseTypesSupported.contains(responseType)) {
+ throw new MessageHandlerException("OpenID Provider does not support chosen response_type: "
+ + responseType.toString());
+ }
+ }
+
+ /**
+ * Check the OpenID Provider supports the response_mode from its metadata value response_modes_supported. Throws
+ * an exception if not.
+ *
+ * @param responseMode the response_mode to check is supported
+ *
+ * @throws MessageHandlerException if the OpenID Provider does not support the response_mode
+ */
+ private void checkProviderSupportsResponseMode(@Nonnull final ResponseMode responseMode)
+ throws MessageHandlerException {
+ final List<ResponseMode> responseModesSupportedOP = getProviderMetadata().getResponseModes();
+ final List<ResponseMode> responseModesSupported = new ArrayList<>(2);
+ if (responseModesSupportedOP == null || responseModesSupportedOP.isEmpty()) {
+ // Add the defaults from the specification
+ responseModesSupported.add(ResponseMode.QUERY);
+ responseModesSupported.add(ResponseMode.FRAGMENT);
+ } else {
+ responseModesSupportedOP.forEach(responseModesSupported::add);
+ }
+ if (!responseModesSupported.contains(responseMode)) {
+ throw new MessageHandlerException("OpenID Provider does not support chosen response_mode: "
+ + responseMode.toString());
+ }
+
+ }
+
/**
* Parse the response_type into a known {@link ResponseType}.
*
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/logic/package-info.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/package-info.java
similarity index 88%
copy from idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/logic/package-info.java
copy to idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/package-info.java
index 815438a..cae7609 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/logic/package-info.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/package-info.java
@@ -16,6 +16,6 @@
*/
/**
- * Package that contains configuration logic
+ * Shibboleth relying-party proxy implementation.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.config.logic;
\ No newline at end of file
+package net.shibboleth.idp.plugin.authn.oidc.rp;
\ No newline at end of file
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 6dea37d..ed20f06 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -10,14 +10,7 @@
default-init-method="initialize" default-destroy-method="destroy">
<!-- System beans needed for the extension to function, loaded after global.xml. -->
-
- <bean id="shibboleth.authn.oidc.rp.JWKCredential" abstract="true"
- class="net.shibboleth.oidc.security.credential.impl.BasicJWKCredentialFactoryBean" />
- <bean id="shibboleth.authn.oidc.rp.ExpiringJWKCredential" abstract="true"
- class="net.shibboleth.oidc.security.credential.impl.BasicExpiringJWTSharedSecretCredentialFactoryBean"
- p:credentialExpiresAt="%{idp.authn.oidc.rp.client.clientSecretExpiresAt:PT0S}" />
-
<!--
Internal versions of the Http Request/Reponse proxies to easy the transition to IdP 5.0.
@@ -126,10 +119,10 @@
c:g-ref="shibboleth.ChildLookup.OIDCPeerEntityContext" c:f-ref="shibboleth.MessageContextLookup.Inbound" />
<bean id="shibboleth.ChildLookup.Proxy.MessageContextLookup.Inbound"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.InboundMessageContextFromProxyPRC"/>
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate.InboundMessageContextFromProxyPRC"/>
<bean id="shibboleth.ChildLookup.Proxy.MessageContextLookup.Outbound"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.OutboundMessageContextFromProxyPRC"/>
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate.OutboundMessageContextFromProxyPRC"/>
<bean id="shibboleth.MessageLookup.oidc.rp.OIDCAuthenticationRequest"
class="org.opensaml.messaging.context.navigate.MessageLookup"
@@ -178,7 +171,7 @@
<!-- lookup strategies required by the postconfig in addition to the flow -->
<bean id="shibboleth.authn.oidc.rp.DefaultIDTokenLookupStrategy"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.DefaultIDTokenLookupStrategy" />
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate.DefaultIDTokenLookupStrategy" />
<bean p:id="OIDCSubjectIdentifier" class="net.shibboleth.idp.authn.principal.GenericPrincipalService"
c:claz="net.shibboleth.idp.plugin.authn.oidc.rp.principal.OIDCSubjectIdentifierPrincipal">
@@ -217,9 +210,6 @@
</property>
</bean>
- <!-- TODO check this -->
- <bean id="issuer" class="java.lang.String" c:_0="%{idp.authn.oidc.rp.issuer:%{idp.entityID}}" />
-
<!-- Necessary for encoder parsing and claims mapping to function. -->
<bean parent="shibboleth.RegistryNamingFunction" c:claz="net.minidev.json.JSONObject">
<constructor-arg name="function">
@@ -274,15 +264,6 @@
</property>
</bean>
- <!--
- JWK Cache service for provider keys. Will use the same storage engine and context and
- the OP. The key is the URI, so that should be fine.
- -->
- <bean id="shibboleth.authn.oidc.rp.RemoteJwkSetCache" class="net.shibboleth.oidc.jwk.RemoteJwkSetCache"
- p:storage-ref="#{'%{idp.oidc.rp.jwk.StorageService:shibboleth.StorageService}'.trim()}"
- p:httpClient="#{getObject('shibboleth.authn.oidc.rp.NonBrowser.HttpClient') ?: getObject('shibboleth.InternalHttpClient')}"
- p:httpClientSecurityParameters="#{getObject('shibboleth.authn.oidc.rp.NonBrowser.HttpClientSecurityParameters')}" />
-
<!--
Some RP audit extractors
@@ -482,7 +463,7 @@
</bean>
<bean id="shibboleth.authn.oidc.rp.DefaultEndUserClaimsLookupStrategy"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.DefaultEndUserClaimsLookupStrategy"
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate.DefaultEndUserClaimsLookupStrategy"
c:endUserClaimsContextLookupStrategy="#{getObject('shibboleth.authn.oidc.rp.EndUserClaimsContextLookupStrategy')}"/>
<bean id="shibboleth.authn.oidc.rp.DefaultTokenResponseAuditExtractors" lazy-init="true"
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
index 483d291..700d0ab 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
@@ -179,14 +179,16 @@
p:providerMetadataAlgorithmLookupStrategy-ref="shibboleth.authn.oidc.rp.RequestObjectSupportedSignatureSigningAlgorithms" />
<bean id="shibboleth.authn.oidc.rp.RequestObjectSupportedSignatureSigningAlgorithms" scope="prototype"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic.RequestObjectSupportedSignatureSigningAlgorithms" />
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.navigate.RequestObjectSupportedSignatureSigningAlgorithms" />
<bean id="RequestObjectSignatureSigningConfigurationLookup" lazy-init="true"
class="net.shibboleth.oidc.profile.config.navigate.JWTSignatureSigningConfigurationLookupFunction"
p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
+ <!-- if the activation condition succeeds, encryption is not optional -->
<bean id="PopulateRequestObjectEncryptionParameters"
class="net.shibboleth.oidc.profile.impl.PopulateJWTEncryptionParameters" scope="prototype"
+ p:encryptionOptional="false"
p:forFriendlyName="Request Object"
p:configurationLookupStrategy-ref="RequestObjectEncryptionConfigurationLookup"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
@@ -275,11 +277,11 @@
scope="prototype" p:logName="RequestObject">
<property name="claimsToSignLookupStrategy">
<bean
- class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic.JWTClaimsSetFromRequestObjectLookupFunction" />
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.navigate.JWTClaimsSetFromRequestObjectLookupFunction" />
</property>
<property name="jwtUpdateConsumer">
<bean
- class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.RequestObjectTokenUpdateStrategy" />
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate.RequestObjectTokenUpdateStrategy" />
</property>
</bean>
@@ -288,11 +290,11 @@
p:logName="RequestObject">
<property name="payloadToEncryptLookupStrategy">
<bean
- class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic.PayloadFromRequestObjectLookupFunction" />
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.navigate.PayloadFromRequestObjectLookupFunction" />
</property>
<property name="jwtUpdateConsumer">
<bean
- class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.RequestObjectTokenUpdateStrategy" />
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate.RequestObjectTokenUpdateStrategy" />
</property>
</bean>
</list>
@@ -357,9 +359,9 @@
p:fieldExtractors="#{getObject('shibboleth.authn.oidc.rp.AuthenticationResponseAuditExtractors') ?: getObject('shibboleth.authn.oidc.rp.DefaultAuthenticationResponseAuditExtractors')}" />
- <bean id="IsCodeFlow" class="net.shibboleth.idp.plugin.authn.oidc.rp.config.logic.IsCodeFlowPredicate" />
- <bean id="IsHybridFlow" class="net.shibboleth.idp.plugin.authn.oidc.rp.config.logic.IsHybridFlowPredicate" />
- <bean id="IsImplicitFlow" class="net.shibboleth.idp.plugin.authn.oidc.rp.config.logic.IsImplicitFlowPredicate" />
+ <bean id="IsCodeFlow" class=" net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic.IsCodeFlowPredicate" />
+ <bean id="IsHybridFlow" class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic.IsHybridFlowPredicate" />
+ <bean id="IsImplicitFlow" class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic.IsImplicitFlowPredicate" />
<!-- CODE flow beans -->
@@ -388,7 +390,7 @@
p:rawIdTokenLookupStrategy-ref="TokenResponseIDTokenLookupStrategy" />
<bean id="TokenResponseIDTokenLookupStrategy"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.TokenResponseIDTokenLookupStrategy" />
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate.TokenResponseIDTokenLookupStrategy" />
<!-- could these be singletons? -->
<bean id="shibboleth.authn.oidc.rp.DefaultTokenResponseDecoder" scope="prototype"
@@ -441,10 +443,7 @@
class="net.shibboleth.oidc.profile.config.navigate.JWTDecryptionConfigurationLookupFunction"
p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
- <bean id="IDTokenInAccessTokenUpdateStrategy"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.IDTokenInAccessTokenUpdateStrategy" />
-
- <bean id="DecryptJWT" class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.DecryptJWT" scope="prototype"
+ <bean id="DecryptIDTokenJWE" class="net.shibboleth.oidc.security.impl.DecryptJWE" scope="prototype"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext">
<property name="jwtTokenLookupStrategy">
<bean class="net.shibboleth.idp.profile.context.navigate.SpringExpressionContextLookupFunction"
@@ -453,7 +452,7 @@
c:expression="#input.getInboundMessageContext().getSubcontext(T(net.shibboleth.idp.plugin.authn.oidc.rp.context.AccessTokenResponseContext)).getIdToken()" />
</property>
<property name="jwtUpdateStrategy">
- <ref bean="IDTokenInAccessTokenUpdateStrategy" />
+ <bean class="net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate.IDTokenInAccessTokenUpdateStrategy" />
</property>
</bean>
@@ -511,7 +510,7 @@
</bean>
<bean id="shibboleth.authn.oidc.rp.IDTokenRequiresSignatureVerificationCondition" scope="prototype"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.config.logic.RequiresSignatureVerificationPredicate"
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic.RequiresSignatureVerificationPredicate"
p:tlsServerValidationOnly="%{idp.authn.oidc.rp.client.idtoken.tlsServerValidationOnly:false}"
c:authenticatableOIDCContextLookupStrategy-ref="shibboleth.ChildLookup.AccessTokenResponseContext"/>
@@ -603,7 +602,7 @@
<!-- TODO This bean could be replaced by XML functions? Could also be from the inbound message context at this point -->
<bean id="OIDCProviderMetadataContextFromOutboundPeerLookupStrategy"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.OIDCProviderMetadataFromOuboundPeerLookupStrategy" />
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate.OIDCProviderMetadataFromOuboundPeerLookupStrategy" />
<bean id="AudienceClaimsValidator" class="net.shibboleth.oidc.security.jwt.claims.impl.AudienceClaimsValidator"
p:audienceLookupStrategy-ref="ClientIDFromOAuth2ClientContextFunction"
@@ -615,7 +614,7 @@
</bean>
<bean id="ClientIDFromOAuth2ClientContextFunction"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.ClientIDFromOAuth2ClientContextFunction"
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate.ClientIDFromOAuth2ClientContextFunction"
c:oauth2ClientContextLookupStrategy-ref="shibboleth.ChildLookup.OAuth2ClientContextFromOutbound" />
<bean id="NonceClaimValidator" class="net.shibboleth.oidc.security.jwt.claims.impl.ExactMatchClaimsValidator"
@@ -645,10 +644,10 @@
getObject('shibboleth.authn.oidc.rp.jwt.DefaultIDTokenJOSEHeaderLookupStrategy')}"/>
<bean id="shibboleth.authn.oidc.rp.jwt.DefaultTokenResponseLookupStrategy"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.RawTokenResponseLookupStrategy"/>
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate.RawTokenResponseLookupStrategy"/>
<bean id="shibboleth.authn.oidc.rp.jwt.DefaultIDTokenJOSEHeaderLookupStrategy"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.IDTokenJOSEHeaderLookupStrategy"/>
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate.IDTokenJOSEHeaderLookupStrategy"/>
<bean id="AuthenticationTimeClaimValidator"
class="net.shibboleth.oidc.security.jwt.claims.impl.AuthenticationTimeClaimsValidator"
@@ -712,10 +711,9 @@
class="net.shibboleth.oidc.profile.config.navigate.JWTDecryptionConfigurationLookupFunction"
p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
- <bean id="UserInfoInUserInfoResponseContextUpdateStrategy"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.UserInfoInUserInfoResponseContextUpdateStrategy" />
+
- <bean id="DecryptUserInfoJWT" class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.DecryptJWT" scope="prototype"
+ <bean id="DecryptUserInfoJWE" class="net.shibboleth.oidc.security.impl.DecryptJWE" scope="prototype"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext">
<property name="jwtTokenLookupStrategy">
<bean class="net.shibboleth.idp.profile.context.navigate.SpringExpressionContextLookupFunction"
@@ -724,7 +722,7 @@
c:expression="#input.getInboundMessageContext().getSubcontext(T(net.shibboleth.idp.plugin.authn.oidc.rp.context.UserInfoResponseContext)).getUserInfo().getResponseJwt()" />
</property>
<property name="jwtUpdateStrategy">
- <ref bean="UserInfoInUserInfoResponseContextUpdateStrategy" />
+ <bean class="net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate.UserInfoInUserInfoResponseContextUpdateStrategy" />
</property>
</bean>
@@ -784,7 +782,7 @@
</bean>
<bean id="shibboleth.authn.oidc.rp.DefaultUserInfoTokenLookupStrategy"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.DefaultUserInfoTokenLookupStrategy" />
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate.DefaultUserInfoTokenLookupStrategy" />
<bean id="ValidateUserInfoTokenClaims" scope="prototype"
class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.ValidateTokenClaims"
@@ -819,7 +817,7 @@
<bean id="SubMatchesIDTokenClaimValidator"
class="net.shibboleth.oidc.security.jwt.claims.impl.ExactMatchClaimsValidator" p:claimName="sub">
<property name="valueToMatchLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.SubFromIDTokenLookupFunction" />
+ <bean class="net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate.SubFromIDTokenLookupFunction" />
</property>
</bean>
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-flow.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-flow.xml
index d8ac1d0..0344758 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-flow.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-flow.xml
@@ -117,7 +117,7 @@
<evaluate expression="ValidateOAuthAccessTokenResponse" />
<evaluate expression="ExtractIDTokenFromTokenResponse" />
<evaluate expression="PopulateIDTokenDecryptionParameters" />
- <evaluate expression="DecryptJWT" />
+ <evaluate expression="DecryptIDTokenJWE" />
<!--Validation of the JWT signature is optional if TLS server validation was performed -->
<evaluate expression="IDTokenSignatureValidation" />
<evaluate expression="ValidateIDTokenClaims" />
@@ -147,7 +147,7 @@
<!-- Actions to perform if the UserInfo response is a JWT type -->
<action-state id="ValidateUserInfoJWT">
<evaluate expression="PopulateUserInfoDecryptionParameters" />
- <evaluate expression="DecryptUserInfoJWT" />
+ <evaluate expression="DecryptUserInfoJWE" />
<evaluate expression="UserInfoTokenSignatureValidation" />
<evaluate expression="ValidateUserInfoTokenClaims" />
<evaluate expression="PostJWTUserInfoResponsePopulateAuditContext" />
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/rp/keyset/keyset-beans.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/rp/keyset/keyset-beans.xml
index bef03d6..ce33c2d 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/rp/keyset/keyset-beans.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/rp/keyset/keyset-beans.xml
@@ -50,14 +50,15 @@
<bean id="EncodeMessage" class="org.opensaml.profile.action.impl.EncodeMessage" scope="prototype"
p:messageEncoderFactory-ref="shibboleth.authn.oidc.rp.keyset.messageEncoderFactory"
- p:httpServletResponse-ref="shibboleth.HttpServletResponse" />
+ p:httpServletResponse-ref="shibboleth.authn.oidc.rp.internal.HttpServletResponse" />
<bean id="shibboleth.authn.oidc.rp.keyset.messageEncoderFactory"
class="net.shibboleth.oidc.profile.encoding.impl.OIDCResponseEncoderFactory"
p:messageEncoder-ref="shibboleth.authn.oidc.rp.keyset.nimbusEncoder" scope="prototype" />
- <bean id="shibboleth.authn.oidc.rp.keyset.nimbusEncoder" class="net.shibboleth.oidc.profile.encoding.impl.SimpleNimbusResponseEncoder"
- scope="prototype" p:httpServletResponse-ref="shibboleth.HttpServletResponse" init-method="" />
+ <bean id="shibboleth.authn.oidc.rp.keyset.nimbusEncoder"
+ class="net.shibboleth.oidc.profile.encoding.impl.SimpleNimbusResponseEncoder" scope="prototype"
+ p:httpServletResponse-ref="shibboleth.authn.oidc.rp.internal.HttpServletResponse" init-method="" />
<bean id="RecordResponseComplete" class="net.shibboleth.idp.profile.impl.RecordResponseComplete"
scope="prototype" />
@@ -69,12 +70,12 @@
p:formattingMap-ref="shibboleth.AuditFormattingMap"
p:dateTimeFormat="#{getObject('shibboleth.AuditDateTimeFormat')}"
p:useDefaultTimeZone="#{getObject('shibboleth.AuditDefaultTimeZone') ?: false}"
- p:httpServletRequest-ref="shibboleth.HttpServletRequest" />
+ p:httpServletRequest-ref="shibboleth.authn.oidc.rp.internal.HttpServletRequest" />
<bean id="BuildErrorResponseFromEvent"
class="net.shibboleth.oidc.profile.impl.BuildJSONErrorResponseFromEvent" scope="prototype"
p:defaultStatusCode="500" p:defaultCode="server_error"
- p:httpServletResponse-ref="shibboleth.HttpServletResponse">
+ p:httpServletResponse-ref="shibboleth.authn.oidc.rp.internal.HttpServletResponse">
<property name="eventContextLookupStrategy">
<bean class="net.shibboleth.idp.profile.context.navigate.WebFlowCurrentEventLookupFunction" />
</property>
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/attribute/registry/postconfig.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/attribute/registry/postconfig.xml
deleted file mode 100644
index 0409f2f..0000000
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/attribute/registry/postconfig.xml
+++ /dev/null
@@ -1,27 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
- xmlns:context="http://www.springframework.org/schema/context"
- xmlns:util="http://www.springframework.org/schema/util"
- xmlns:p="http://www.springframework.org/schema/p"
- xmlns:c="http://www.springframework.org/schema/c"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-
- default-init-method="initialize" default-destroy-method="destroy">
-
- <!-- Necessary for encoder parsing and claims mapping to function. -->
-
- <bean id="OIDCByteTranscoder"
- class="net.shibboleth.oidc.attribute.transcoding.impl.OIDCByteAttributeTranscoder" />
-
- <bean id="OIDCStringTranscoder"
- class="net.shibboleth.oidc.attribute.transcoding.impl.OIDCStringAttributeTranscoder" />
-
- <bean id="OIDCScopedStringTranscoder"
- class="net.shibboleth.oidc.attribute.transcoding.impl.OIDCScopedStringAttributeTranscoder" />
-
-
-
-</beans>
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index cfb5b05..3a1c5b4 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -10,308 +10,6 @@
default-init-method="initialize" default-destroy-method="destroy">
- <!--
- Security Configuration Defaults. These settings establish the default security configurations for
- signatures and loads the default credentials used.
- -->
- <bean id="shibboleth.authn.oidc.rp.BasicSignatureValidationConfiguration" abstract="true"
- class="net.shibboleth.oidc.security.jose.impl.BasicSignatureValidationConfiguration"
- p:includedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.IncludedSignatureAlgorithms')}"
- p:excludedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.ExcludedSignatureAlgorithms')}" />
-
- <bean id="shibboleth.authn.oidc.rp.BasicSignatureSigningConfiguration" abstract="true"
- class="net.shibboleth.oidc.security.jose.impl.BasicSignatureSigningConfiguration"
- p:includedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.IncludedSignatureAlgorithms')}"
- p:excludedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.ExcludedSignatureAlgorithms')}" />
-
- <bean id="shibboleth.authn.oidc.rp.BasicEncryptionConfiguration" abstract="true"
- class="net.shibboleth.oidc.security.jose.impl.BasicEncryptionConfiguration"
- p:includedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.IncludedEncryptionAlgorithms')}"
- p:excludedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.ExcludedEncryptionAlgorithms')}" />
-
- <bean id="shibboleth.authn.oidc.rp.BasicDecryptionConfiguration" abstract="true"
- class="net.shibboleth.oidc.security.jose.impl.BasicDecryptionConfiguration"
- p:includedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.IncludedEncryptionAlgorithms')}"
- p:excludedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.ExcludedEncryptionAlgorithms')}" />
-
-
-
- <!-- This was all moved to commons. TODO I moved this back for the time being -->
-
- <bean id="AbstractOIDCProfile" abstract="true"
- p:securityConfiguration-ref="%{idp.security.authn.oidc.rp.config:shibboleth.authn.oidc.rp.DefaultSecurityConfiguration}" />
-
- <bean id="AbstractOIDCSSOProfile" parent="AbstractOIDCProfile" abstract="true"
- p:issuer-ref="issuer"
- p:tokenEndpointAuthMethods="%{idp.authn.oidc.rp.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}"/>
-
- <bean id="OIDC.SSO" parent="AbstractOIDCSSOProfile" lazy-init="true"
- class="net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration"
- p:httpRequestMethod="%{idp.authn.oidc.rp.httpRequestMethod:GET}"
- p:clientId="#{%{idp.authn.oidc.rp.provider.discoveryRequired:false} == true ? null : '%{idp.authn.oidc.rp.client.clientId:}'}"
- p:clientCredential="#{%{idp.authn.oidc.rp.provider.discoveryRequired:false} == true ? {null} : getObject('shibboleth.authn.oidc.rp.DefaultCredential')}"
- p:tokenEndpointAuthMethods="%{idp.authn.oidc.rp.client.authenticationMethod:client_secret_basic}"
- p:responseMode="%{idp.authn.oidc.rp.client.responseMode:#{null}}"
- p:retrieveUserInfoEndpointClaims="%{idp.authn.oidc.rp.client.userinfo.enabled:true}"
- p:redirectUriOverride="%{idp.authn.oidc.rp.client.redirectURI:#{null}}"
- p:encryptRequestObject="%{idp.authn.oidc.rp.client.requestobject.encrypted:false}"
- p:signRequestObject="%{idp.authn.oidc.rp.client.requestobject.signed:true}"
- p:useRequestObject="%{idp.authn.oidc.rp.client.requestobject.supported:false}"
- p:scopes="%{idp.authn.oidc.rp.client.scopes:#{null}}">
- <property name="forceAuthnPredicate">
- <bean class="net.shibboleth.idp.saml.profile.config.logic.ProxyAwareForceAuthnPredicate" />
- </property>
- <property name="defaultAuthenticationMethodsLookupStrategy">
- <bean
- class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassRequestLookupFunction"
- p:mappings="#{getObject('shibboleth.authn.oidc.rp.PrincipalProxyRequestMappings')}" />
- </property>
- <property name="authenticationContextClassReferenceTranslationStrategyLookupStrategy">
- <bean
- class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction$LookupFunctionWrapper">
- <constructor-arg>
- <bean class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction"
- c:mappings="#{getObject('shibboleth.authn.oidc.rp.PrincipalProxyResponseMappings')}"/>
- </constructor-arg>
- </bean>
- </property>
- <property name="authenticationMethodsReferencesTranslationStrategyLookupStrategy">
- <bean
- class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction$LookupFunctionWrapper">
- <constructor-arg>
- <bean class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction"
- c:mappings="#{getObject('shibboleth.authn.oidc.rp.PrincipalProxyResponseMappings')}"/>
- </constructor-arg>
- </bean>
- </property>
- </bean>
-
- <!-- Keyset profile -->
- <bean id="OIDC.Keyset" parent="AbstractOIDCProfile" lazy-init="true"
- class="net.shibboleth.oidc.profile.config.OIDCPublishKeySetConfiguration"
- p:securityConfiguration-ref="shibboleth.authn.oidc.rp.PublishKeySetSecurityConfiguration" />
-
- <!-- Configuration for publishing key set. -->
- <bean id="shibboleth.authn.oidc.rp.PublishKeySetSecurityConfiguration"
- class="net.shibboleth.oidc.profile.config.JSONSecurityConfiguration">
- <property name="jwtSignatureSigningConfiguration">
- <ref bean="shibboleth.authn.oidc.rp.PublishKeySetSigningConfiguration" />
- </property>
- <property name="jwtDecryptionConfiguration">
- <ref bean="shibboleth.authn.oidc.rp.PublishKeySetDecryptionConfiguration" />
- </property>
- </bean>
-
- <bean id="shibboleth.authn.oidc.rp.PublishKeySetSigningConfiguration" parent="shibboleth.authn.oidc.rp.BasicSignatureSigningConfiguration"
- p:signingCredentials="#{getObject('shibboleth.authn.oidc.rp.SigningCredentialsToPublish') ?: getObject('shibboleth.authn.oidc.rp.SigningCredentials')}"/>
-
- <!-- This is a simplified version of the decryption config to access the public encryption key -->
- <bean id="shibboleth.authn.oidc.rp.PublishKeySetDecryptionConfiguration" parent="shibboleth.authn.oidc.rp.BasicDecryptionConfiguration">
- <property name="KEKCredentialResolver">
- <bean id="defaultOIDCRPKeyDecryptionCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.ReturnAllCollectionJOSEObjectCredentialResolver"
- c:credentials="#{getObject('shibboleth.authn.oidc.rp.EncryptionCredentialsToPublish') ?: getObject('shibboleth.authn.oidc.rp.DefaultEncryptionCredentialsToPublish')}"/>
- </property>
- </bean>
-
- <bean id="shibboleth.authn.oidc.rp.DefaultEncryptionCredentialsToPublish"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.config.CredentialsListFactory"
- c:_0="#{getObject('shibboleth.authn.oidc.rp.DefaultKeyEncryptionCredentials')}" />
-
-
- <bean id="shibboleth.authn.oidc.rp.DefaultSecurityConfiguration"
- class="net.shibboleth.oidc.profile.config.JSONSecurityConfiguration">
- <property name="jwtDecryptionConfiguration">
- <ref
- bean="#{'%{idp.authn.oidc.rp.idtoken.decrypt.config:shibboleth.authn.oidc.rp.DefaultJWTDecryptionConfiguration}'.trim()}" />
- </property>
- <property name="jwtSignatureValidationConfiguration">
- <ref
- bean="#{'%{idp.authn.oidc.rp.idtoken.valid.config:shibboleth.authn.oidc.rp.DefaultJWTSignatureValidationConfiguration}'.trim()}" />
- </property>
- <property name="jwtSignatureSigningConfiguration">
- <ref
- bean="#{'%{idp.authn.oidc.rp.requestobject.signing.config:shibboleth.authn.oidc.rp.DefaultJWTSigningConfiguration}'.trim()}" />
- </property>
- <property name="jwtEncryptionConfiguration">
- <ref
- bean="#{'%{idp.authn.oidc.rp.requestobject.encryption.config:shibboleth.authn.oidc.rp.DefaultJWTEncryptionConfiguration}'.trim()}" />
- </property>
- </bean>
-
- <!--
- See https://openid.net/specs/openid-connect-core-1_0.html#Encryption. But encryption is either based
- on published OP keys, or the client_secret, so we can not allow abitrarily configured keys
- -->
- <bean id="shibboleth.authn.oidc.rp.DefaultJWTEncryptionConfiguration"
- parent="shibboleth.authn.oidc.rp.BasicEncryptionConfiguration"
- p:KEKCredentialResolver-ref="defaultOIDCRPKeyEncryptionCredentialResolver"
- p:contentEncryptionKeyCredentialResolver-ref="defaultOIDCRPContentEncryptionKeyCredentialResolver">
- <property name="keyTransportEncryptionAlgorithms">
- <list>
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_RSA_1_5" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_RSA_OAEP" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_RSA_OAEP_256" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_128_KW" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_192_KW" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_256_KW" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_128_GCM_KW" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_192_GCM_KW" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_256_GCM_KW" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_ECDH_ES" />
- </list>
- </property>
- <property name="dataEncryptionAlgorithms">
- <list>
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A128GCM" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A192GCM" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A256GCM" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A128CBC_HS256" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A192CBC_HS384" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A256CBC_HS512" />
- </list>
- </property>
- </bean>
-
- <bean id="shibboleth.authn.oidc.rp.DefaultJWTSigningConfiguration"
- parent="shibboleth.authn.oidc.rp.BasicSignatureSigningConfiguration"
- p:signingCredentials-ref="shibboleth.authn.oidc.rp.SigningCredentials">
- <property name="signatureAlgorithms">
- <list>
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_RS_256" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_RS_384" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_RS_512" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_HS_256" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_HS_384" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_HS_512" />
- </list>
- </property>
- </bean>
-
- <bean id="shibboleth.authn.oidc.rp.DefaultJWTDecryptionConfiguration"
- parent="shibboleth.authn.oidc.rp.BasicDecryptionConfiguration"
- p:KEKCredentialResolver-ref="defaultOIDCRPKeyDecryptionCredentialResolver"
- p:contentEncryptionKeyCredentialResolver-ref="defaultOIDCRPContentDecryptionKeyCredentialResolver" />
-
-
- <bean id="shibboleth.authn.oidc.rp.SigningCredentials"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.config.CredentialsListFactory"
- c:_0="#{getObject('shibboleth.authn.oidc.rp.DefaultSigningCredentials')}" />
-
-
- <!--
- A resolver to public/private key encryption keys global to the RP
- -->
- <bean id="defaultOIDCRPKeyDecryptionCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
- <constructor-arg>
- <list>
- <bean class="net.shibboleth.oidc.security.credential.impl.LocalJOSEObjectCredentialResolver">
- <constructor-arg name="localCredentialResolver">
- <bean
- class="net.shibboleth.oidc.security.credential.impl.CollectionJOSEObjectCredentialResolver"
- c:credentials-ref="shibboleth.authn.oidc.rp.DefaultKeyEncryptionCredentials" />
- </constructor-arg>
- </bean>
- <bean id="CriterionCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.CriterionCredentialResolver" />
- </list>
- </constructor-arg>
- </bean>
-
- <!--
- A resolver to resolve a pre-shared Direct Encryption key e.g. a pairwise client_secret from the input criterion
- from which to derive the decryption key.
- -->
- <bean id="defaultOIDCRPContentDecryptionKeyCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
- <constructor-arg>
- <list>
- <bean id="CriterionCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.CriterionCredentialResolver" />
- </list>
- </constructor-arg>
- </bean>
-
- <!-- A resolver to public key encryption in the OPs metadata alongside the client_secret for key wrapping -->
- <bean id="defaultOIDCRPKeyEncryptionCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
- <constructor-arg>
- <list>
- <bean id="OIDCProviderMetadataCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.ProviderMetadataCredentialResolver"
- p:remoteJwkSetCache-ref="shibboleth.authn.oidc.rp.RemoteJwkSetCache"
- p:keyFetchInterval="%{idp.authn.oidc.rp.provider.keyfetch.interval:PT30M}" />
- <bean id="CriterionCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.CriterionCredentialResolver" />
- </list>
- </constructor-arg>
- </bean>
-
- <!--
- A resolver to resolve pre-shared Direct Encryption or Key Wrapping credentials based on the
- client_secret in the input criterion. Returns the raw value, even though the key to use
- is a derivative of this key.
- -->
- <bean id="defaultOIDCRPContentEncryptionKeyCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
- <constructor-arg>
- <list>
- <bean id="CriterionCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.CriterionCredentialResolver" />
- </list>
- </constructor-arg>
- </bean>
-
- <bean id="shibboleth.authn.oidc.rp.DefaultJWTSignatureValidationConfiguration"
- parent="shibboleth.authn.oidc.rp.BasicSignatureValidationConfiguration"
- p:signatureTrustEngine-ref="ExplicitKeySignedJWTTrustEngine">
- </bean>
-
- <!-- A resolver for resolving trusted credentials to match against those resolved from the JWT -->
- <bean id="defaultSignedJWTTrustedCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
- <constructor-arg>
- <list>
- <bean id="OIDCProviderMetadataCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.ProviderMetadataCredentialResolver"
- p:remoteJwkSetCache-ref="shibboleth.authn.oidc.rp.RemoteJwkSetCache"
- p:keyFetchInterval="%{idp.authn.oidc.rp.provider.keyfetch.interval:PT30M}"/>
- <bean id="CriterionCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.CriterionCredentialResolver" />
- </list>
- </constructor-arg>
- </bean>
-
- <!-- A resolver for resolving 'untrusted' credentials out of the JOSE header of JWTs -->
- <bean id="defaultSignedJWTJOSEHeaderCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver" />
-
- <bean id="ExplicitKeySignedJWTTrustEngine"
- class="net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine"
- c:resolver-ref="defaultSignedJWTTrustedCredentialResolver"
- c:JOSEObjectResolver-ref="defaultSignedJWTJOSEHeaderCredentialResolver" />
-
+ <!-- Any additional relying-party configuration required by the RP -->
+
</beans>
diff --git a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-claim-rules.xml b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-claim-rules.xml
deleted file mode 100644
index 9de853b..0000000
--- a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-claim-rules.xml
+++ /dev/null
@@ -1,428 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
- xmlns:context="http://www.springframework.org/schema/context"
- xmlns:util="http://www.springframework.org/schema/util"
- xmlns:p="http://www.springframework.org/schema/p"
- xmlns:c="http://www.springframework.org/schema/c"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-
- default-init-method="initialize"
- default-destroy-method="destroy">
-
- <!-- https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims -->
-
- <bean parent="shibboleth.TranscodingRuleLoader">
- <constructor-arg>
- <list>
-
- <!-- Typical inetOrgPerson attributes that map to standard claims. -->
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">displayName</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.name">name</prop>
- <prop key="displayName.en">Display name</prop>
- <prop key="displayName.de">Anzeigename</prop>
- <prop key="displayName.fr">Nom</prop>
- <prop key="displayName.it">Nome</prop>
- <prop key="displayName.ja">表示名</prop>
- <prop key="description.en">The name that should appear in white-pages-like applications for this person.</prop>
- <prop key="description.de">Anzeigename</prop>
- <prop key="description.fr">Nom complet d'affichage</prop>
- <prop key="description.it">Nome</prop>
- <prop key="description.ja">アプリケーションでの表示に用いられる英字氏名</prop>
- </props>
- </property>
- </bean>
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">givenName</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.name">given_name</prop>
- <prop key="displayName.en">Given name</prop>
- <prop key="displayName.de">Vorname</prop>
- <prop key="displayName.fr">Prénom</prop>
- <prop key="displayName.it">Nome</prop>
- <prop key="displayName.ja">名</prop>
- <prop key="description.en">Given name of a person</prop>
- <prop key="description.de">Vorname</prop>
- <prop key="description.fr">Prénom de l'utilisateur</prop>
- <prop key="description.it">Nome</prop>
- <prop key="description.ja">氏名(名)の英語表記</prop>
- </props>
- </property>
- </bean>
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">homePhone</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.name">phone_number</prop>
- <prop key="displayName.en">Private phone number</prop>
- <prop key="displayName.de">Telefon Privat</prop>
- <prop key="displayName.fr">Teléphone personnel</prop>
- <prop key="displayName.it">Numero di telefono privato</prop>
- <prop key="displayName.ja">自宅電話番号</prop>
- <prop key="description.en">Private phone number</prop>
- <prop key="description.de">Private Telefonnummer</prop>
- <prop key="description.fr">Numéro de téléphone de domicile de la personne</prop>
- <prop key="description.it">Numero di telefono privato</prop>
- <prop key="description.ja">自宅の電話番号</prop>
- </props>
- </property>
- </bean>
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">mail</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.name">email</prop>
- <prop key="displayName.en">E-mail</prop>
- <prop key="displayName.de">E-Mail</prop>
- <prop key="displayName.fr">Email</prop>
- <prop key="displayName.it">E-mail</prop>
- <prop key="displayName.ja">メールアドレス</prop>
- <prop key="description.en">E-Mail: Preferred address for e-mail to be sent to this person</prop>
- <prop key="description.de">E-Mail-Adresse</prop>
- <prop key="description.de-ch">E-Mail Adresse</prop>
- <prop key="description.fr">Adresse de courrier électronique</prop>
- <prop key="description.it">E-Mail: l'indirizzo e-mail preferito dall'utente</prop>
- <prop key="description.ja">メールアドレス</prop>
- </props>
- </property>
- </bean>
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">preferredLanguage</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.name">locale</prop>
- <prop key="displayName.en">Preferred Language</prop>
- <prop key="displayName.de">Bevorzugte Sprache</prop>
- <prop key="displayName.fr">Langue préférée</prop>
- <prop key="displayName.it">Lingua preferita</prop>
- <prop key="displayName.ja">希望言語</prop>
- <prop key="description.en">Preferred language: Users preferred language (see RFC1766)</prop>
- <prop key="description.de">Bevorzugte Sprache (siehe RFC1766)</prop>
- <prop key="description.fr">Exemple: fr, de, it, en, ... (voir RFC1766)</prop>
- <prop key="description.it">Lingua preferita: la lingua preferita dall'utente (cfr. RFC1766)</prop>
- <prop key="description.ja">利用者が希望する言語(RFC1766 を参照)</prop>
- </props>
- </property>
- </bean>
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">sn</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.name">family_name</prop>
- <prop key="displayName.en">Surname</prop>
- <prop key="displayName.de">Nachname</prop>
- <prop key="displayName.fr">Nom de famille</prop>
- <prop key="displayName.it">Cognome</prop>
- <prop key="displayName.ja">姓</prop>
- <prop key="description.en">Surname or family name</prop>
- <prop key="description.de">Familienname</prop>
- <prop key="description.fr">Nom de famille de l'utilisateur.</prop>
- <prop key="description.it">Cognome dell'utilizzatore</prop>
- <prop key="description.ja">氏名(姓)の英語表記</prop>
- </props>
- </property>
- </bean>
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">telephoneNumber</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.name">phone_number</prop>
- <prop key="displayName.en">Business phone number</prop>
- <prop key="displayName.de">Telefon Geschäft</prop>
- <prop key="displayName.fr">Teléphone professionnel</prop>
- <prop key="displayName.it">Numero di telefono dell'ufficio</prop>
- <prop key="displayName.ja">所属機関内電話番号</prop>
- <prop key="description.en">Business phone number: Office or campus phone number</prop>
- <prop key="description.de">Telefonnummer am Arbeitsplatz</prop>
- <prop key="description.fr">Teléphone de l'institut, de l'université</prop>
- <prop key="description.it">Numero di telefono dell'ufficio</prop>
- <prop key="description.ja">所属機関での利用者の電話番号</prop>
- </props>
- </property>
- </bean>
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">uid</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.name">preferred_username</prop>
- <prop key="displayName.en">User ID</prop>
- <prop key="displayName.de">Benutzer-ID</prop>
- <prop key="displayName.fr">ID utilisateur</prop>
- <prop key="displayName.it">ID dell'utente</prop>
- <prop key="displayName.ja">ユーザID</prop>
- <prop key="description.en">A unique identifier for a person, mainly used for user identification within the user's home organization.</prop>
- <prop key="description.de">Eine eindeutige Nummer für eine Person, welche hauptsächlich zur Identifikation innerhalb der Organisation benutzt wird.</prop>
- <prop key="description.fr">Identifiant de connexion d'une personnes sur les systèmes informatiques.</prop>
- <prop key="description.it">Identificativo unico della persona, usato per l'identificazione dell'utente all'interno della organizzazione di appartenenza.</prop>
- <prop key="description.ja">所属機関内で一意の利用者識別子</prop>
- </props>
- </property>
- </bean>
-
- <!-- eduPerson attributes that map to standard claims. -->
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">eduPersonNickname</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.name">nickname</prop>
- <prop key="displayName.en">Nickname</prop>
- <prop key="displayName.de">Kurzname</prop>
- <prop key="displayName.de-ch">Übername</prop>
- <prop key="displayName.fr">Surnom</prop>
- <prop key="displayName.it">Diminutivo</prop>
- <prop key="displayName.ja">ニックネーム</prop>
- <prop key="description.en">Person's nickname, or the informal name by which they are accustomed to be hailed.</prop>
- <prop key="description.de">Kurzname einer Person, oder üblicher Rufname zur Begrüßung.</prop>
- <prop key="description.de-ch">Übername einer Person, oder üblicher Rufname zur Begrüssung.</prop>
- <prop key="description.fr">Nom personnalisable pour un usage informel.</prop>
- <prop key="description.it">Diminutivo della persona, o soprannome.</prop>
- <prop key="description.ja">利用者のニックネームもしくは通称</prop>
- </props>
- </property>
- </bean>
-
- <!-- A subset of the major eduPerson attributes that have no standard claim mapping. -->
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">eduPersonAssurance</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.name">eduPersonAssurance</prop>
- <prop key="displayName.en">Assurance level</prop>
- <prop key="displayName.de">Vertrauensgrad</prop>
- <prop key="displayName.fr">Niveau de confiance</prop>
- <prop key="displayName.it">Livello di sicurezza</prop>
- <prop key="displayName.ja">保証レベル</prop>
- <prop key="description.en">Set of URIs that assert compliance with specific standards for identity assurance.</prop>
- <prop key="description.de">URIs die eine gewisse Zusicherung für spezifische Standards des Vertrauens beinhalten</prop>
- <prop key="description.fr">Un ensemble d'URI qui attestent la conformité selon un standard pour les niveaux d'assurance d'identités</prop>
- <prop key="description.it">Un insieme di URI che asseriscono l'osservanza dei livelli di sicurezza richiesti</prop>
- <prop key="description.ja">IDの保証レベルに関して特定の基準に準拠していることを示すURI</prop>
- </props>
- </property>
- </bean>
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">eduPersonEntitlement</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.name">eduPersonEntitlement</prop>
- <prop key="displayName.en">Entitlement</prop>
- <prop key="displayName.de">Berechtigung</prop>
- <prop key="displayName.fr">Entitlement</prop>
- <prop key="displayName.it">Prerogativa</prop>
- <prop key="displayName.ja">資格情報</prop>
- <prop key="description.en">Member of: URI (either URL or URN) that indicates a set of rights to specific resources based on an agreement across the releavant community</prop>
- <prop key="description.de">Zeichenkette, die Rechte für spezifische Ressourcen beschreibt</prop>
- <prop key="description.fr">Membre de: URI (soit une URL ou une URN) décrivant un droit spécific d'accès.</prop>
- <prop key="description.it">Membro delle seguenti URI (sia URL o URN) che rappresentano diritti specifici d'accesso validi in tutta la communità</prop>
- <prop key="description.ja">特定のアプリケーションもしくはコミュニティ内の複数リソースへのアクセス権限を持つことを示すURI(URLもしくはURN)</prop>
- </props>
- </property>
- </bean>
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">eduPersonPrincipalName</prop>
- <prop key="transcoder">OIDCScopedStringTranscoder</prop>
- <prop key="oidc.name">eduPersonPrincipalName</prop>
- <prop key="displayName.en">Principal name</prop>
- <prop key="displayName.de">Persönliche ID</prop>
- <prop key="displayName.fr">Principal Name</prop>
- <prop key="displayName.it">Principal Name</prop>
- <prop key="displayName.ja">プリンシパルID</prop>
- <prop key="description.en">A unique identifier for a person, mainly for inter-institutional user identification.</prop>
- <prop key="description.de">Eindeutige Benutzeridentifikation</prop>
- <prop key="description.de-ch">Eindeutige Benützeridentifikation</prop>
- <prop key="description.fr">L'identifiant unique de l'utilisateur</prop>
- <prop key="description.it">Un ID personale che identifica chiaramente l'utente in seno alla sua organizzazione</prop>
- <prop key="description.ja">フェデレーション内で一意かつ永続的な利用者識別子</prop>
- </props>
- </property>
- </bean>
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">eduPersonScopedAffiliation</prop>
- <prop key="transcoder">OIDCScopedStringTranscoder</prop>
- <prop key="oidc.name">eduPersonScopedAffiliation</prop>
- <prop key="displayName.en">Scoped affiliation</prop>
- <prop key="displayName.de">Zugehörigkeit</prop>
- <prop key="displayName.fr">Affiliation</prop>
- <prop key="displayName.it">Tipo di membro</prop>
- <prop key="displayName.ja">スコープ付き職位</prop>
- <prop key="description.en">Specifies the person's affiliation within a particular security domain</prop>
- <prop key="description.de">Art der Zugehörigkeit zur Heimatorganisation</prop>
- <prop key="description.de-ch">Art der Zugehörigkeit zur Heimorganisation</prop>
- <prop key="description.fr">Type d'affiliation dans l'organisation</prop>
- <prop key="description.it">Tipo di membro: Tipo di lavoro svolto per l'organizzazione</prop>
- <prop key="description.ja">セキュリティドメインのスコープが付いた所属機関における職位</prop>
- </props>
- </property>
- </bean>
-
- <!-- The remainder are standard OIDC claims, which we map based on the actual claim name. -->
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">address</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.asObject">true</prop>
- <prop key="oidc.name">address</prop>
- <prop key="displayName.en">Postal address</prop>
- </props>
- </property>
- </bean>
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">birthdate</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.name">birthdate</prop>
- <prop key="displayName.en">Date of birth</prop>
- </props>
- </property>
- </bean>
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">email_verified</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.name">email_verified</prop>
- <prop key="oidc.asBoolean">true</prop>
- <prop key="displayName.en">E-mail verification status</prop>
- <prop key="description.en">Indicates whether e-mail address has been verified by the issuer</prop>
- </props>
- </property>
- </bean>
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">gender</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.name">gender</prop>
- <prop key="displayName.en">Gender</prop>
- </props>
- </property>
- </bean>
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">middle_name</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.name">middle_name</prop>
- <prop key="displayName.en">Middle name</prop>
- </props>
- </property>
- </bean>
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">phone_number_verified</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.name">phone_number_verified</prop>
- <prop key="oidc.asBoolean">true</prop>
- <prop key="displayName.en">Phone number verification status</prop>
- <prop key="description.en">Indicates whether phone number has been verified by the issuer</prop>
- </props>
- </property>
- </bean>
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">picture</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.name">picture</prop>
- <prop key="displayName.en">Picture</prop>
- <prop key="description.en">URL of personal photo</prop>
- </props>
- </property>
- </bean>
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">profile</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.name">profile</prop>
- <prop key="displayName.en">Profile page</prop>
- <prop key="description.en">URL of personal profile page</prop>
- </props>
- </property>
- </bean>
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">website</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.name">website</prop>
- <prop key="displayName.en">Web site</prop>
- <prop key="description.en">URL to personal web site</prop>
- </props>
- </property>
- </bean>
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">updated_at</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.name">updated_at</prop>
- <prop key="oidc.asInteger">true</prop>
- <prop key="displayName.en">Last update of information</prop>
- </props>
- </property>
- </bean>
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">zoneinfo</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.name">zoneinfo</prop>
- <prop key="displayName.en">Time zone</prop>
- </props>
- </property>
- </bean>
-
- </list>
- </constructor-arg>
- </bean>
-
-</beans>
diff --git a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp-credentials.xml b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp-credentials.xml
deleted file mode 100644
index 5cd12b4..0000000
--- a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp-credentials.xml
+++ /dev/null
@@ -1,35 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
- xmlns:context="http://www.springframework.org/schema/context"
- xmlns:util="http://www.springframework.org/schema/util" xmlns:p="http://www.springframework.org/schema/p"
- xmlns:c="http://www.springframework.org/schema/c" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-
- default-init-method="initialize" default-destroy-method="destroy">
-
- <!--
- The default credential is based on the client_secret, and will be the only used credential in most cases.
- The algorithm is not specified, this way it supports both 'direct encryption' and key wrapping management modes.
- UsageType is also not specified, this way making the credential also suitable for verifying message authentication
- codes. The actual key used for encryption is derived from this secret.
- -->
- <bean id="shibboleth.authn.oidc.rp.DefaultCredential" parent="shibboleth.authn.oidc.rp.ExpiringJWKCredential"
- p:secret="%{idp.authn.oidc.rp.client.clientSecret:#{null}}"
- p:keyNames="%{idp.authn.oidc.rp.client.clientSecretKeyName:defaultPropertiesClientSecret}"/>
-
- <!-- Your RP's default encryption (really decryption) keys, set via property file. -->
- <util:list id="shibboleth.authn.oidc.rp.DefaultKeyEncryptionCredentials">
- <bean parent="shibboleth.authn.oidc.rp.JWKCredential" p:failIfResourceIsNull="false"
- p:resource="%{idp.authn.oidc.rp.client.enc.key:#{null}}" />
- </util:list>
-
-
- <!-- Default signing credentials -->
- <util:list id="shibboleth.authn.oidc.rp.DefaultSigningCredentials">
- <bean parent="shibboleth.authn.oidc.rp.JWKCredential" p:failIfResourceIsNull="false"
- p:resource="%{idp.authn.oidc.rp.client.sig.key:#{null}}" />
- </util:list>
-
-</beans>
\ No newline at end of file
diff --git a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp.properties b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp.properties
index 62786c7..431bdf3 100644
--- a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp.properties
+++ b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp.properties
@@ -5,10 +5,6 @@ idp.authn.oidc.rp.client.clientSecret= client_secret
#idp.authn.oidc.rp.client.clientSecretExpiresAt = PT0S
idp.authn.oidc.rp.client.redirecturl.allowedOrigins = https://localhost:8443
-## Uncomment this if you want to enable RSA decryption (where the public key is registered with the OP)
-#idp.authn.oidc.rp.client.enc.key=%{idp.home}/credentials/idp-encryption-rsa.jwk
-#idp.authn.oidc.rp.client.sig.key=%{idp.home}/credentials/idp-signing-rsa.jwk
-
#idp.authn.oidc.rp.provider.discoveryRequired=false
#idp.authn.discoveryURL=http://opdisco.com
@@ -46,5 +42,10 @@ idp.authn.oidc.rp.c14n.subjectidentifier.uppercase = false
idp.authn.oidc.rp.c14n.subjectidentifier.trim = true
idp.authn.oidc.rp.c14n.subjectidentifier.disabled = false
+## Signing and encryption/decryption keys for request objects, id tokens, and userinfo response
+#idp.signing.oidc.rs.key = %{idp.home}/credentials/idp-signing-rs.jwk
+#idp.signing.oidc.es.key = %{idp.home}/credentials/idp-signing-es.jwk
+#idp.signing.oidc.rsa.enc.key = %{idp.home}/credentials/idp-encryption-rsa.jwk
+
diff --git a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/module.properties b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/module.properties
index adb7f3f..2cb52e9 100644
--- a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/module.properties
+++ b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/module.properties
@@ -18,14 +18,6 @@ idp.authn.oidc.RP.2.src = /net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/o
idp.authn.oidc.RP.2.dest = conf/authn/oidc-rp-config.xml
idp.authn.oidc.RP.2.replace = false
-idp.authn.oidc.RP.3.src = /net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp-credentials.xml
-idp.authn.oidc.RP.3.dest = conf/authn/oidc-rp-credentials.xml
-idp.authn.oidc.RP.3.replace = false
-
-idp.authn.oidc.RP.4.src = /net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-providermetadata-resolvers.xml
-idp.authn.oidc.RP.4.dest = conf/authn/oidc-providermetadata-resolvers.xml
-idp.authn.oidc.RP.4.replace = false
-
-idp.authn.oidc.RP.5.src = /net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-claim-rules.xml
-idp.authn.oidc.RP.5.dest = conf/attributes/oidc-claim-rules.xml
-idp.authn.oidc.RP.5.replace = false
\ No newline at end of file
+idp.authn.oidc.RP.3.src = /net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-providermetadata-resolvers.xml
+idp.authn.oidc.RP.3.dest = conf/authn/oidc-providermetadata-resolvers.xml
+idp.authn.oidc.RP.3.replace = false
\ No newline at end of file
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/CredentialsListFactoryTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/CredentialsListFactoryTest.java
deleted file mode 100644
index 8dcdebc..0000000
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/CredentialsListFactoryTest.java
+++ /dev/null
@@ -1,65 +0,0 @@
-package net.shibboleth.idp.plugin.authn.oidc.rp.config;
-
-import static org.testng.Assert.assertNotNull;
-import static org.testng.Assert.assertTrue;
-
-import java.util.ArrayList;
-import java.util.List;
-
-import org.opensaml.security.credential.Credential;
-import org.testng.annotations.Test;
-
-import net.shibboleth.oidc.security.credential.BasicJWKCredential;
-
-/** Tests for the {@link CredentialsListFactory}.*/
-public class CredentialsListFactoryTest {
-
- /**
- * Test with a null input list.
- *
- * @throws Exception on error
- */
- @Test
- public void testNullInputList() throws Exception {
- final CredentialsListFactory factory = new CredentialsListFactory(null);
- factory.afterPropertiesSet();
- final List<Credential> creds = factory.createInstance();
- assertNotNull(creds);
- assertTrue(creds.isEmpty());
- }
-
-
- /**
- * Test with an input list with a null element.
- *
- * @throws Exception on error
- */
- @Test
- public void testInputListWithNullElement() throws Exception {
- final var credsIn = new ArrayList<Credential>();
- credsIn.add(null);
- final CredentialsListFactory factory = new CredentialsListFactory(credsIn);
- factory.afterPropertiesSet();
- final List<Credential> creds = factory.createInstance();
- assertNotNull(creds);
- assertTrue(creds.isEmpty());
- }
-
- /**
- * Test with an input list with one null element.
- *
- * @throws Exception on error
- */
- @Test
- public void testInputListWithOneNullElement() throws Exception {
- final var credsIn = new ArrayList<Credential>();
- credsIn.add(null);
- credsIn.add(new BasicJWKCredential());
- final CredentialsListFactory factory = new CredentialsListFactory(credsIn);
- factory.afterPropertiesSet();
- final List<Credential> creds = factory.createInstance();
- assertNotNull(creds);
- assertTrue(creds.size()==1);
- }
-
-}
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractOIDCTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractOIDCTest.java
index 7badac4..10cc1b5 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractOIDCTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractOIDCTest.java
@@ -31,9 +31,7 @@ import com.nimbusds.oauth2.sdk.id.ClientID;
import com.nimbusds.oauth2.sdk.id.State;
import com.nimbusds.openid.connect.sdk.AuthenticationResponseParser;
import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
-import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
-import net.minidev.json.JSONArray;
import net.minidev.json.JSONObject;
import net.minidev.json.parser.JSONParser;
import net.shibboleth.idp.authn.AuthenticationFlowDescriptor;
@@ -44,7 +42,6 @@ import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
import net.shibboleth.idp.profile.testing.RequestContextBuilder;
import net.shibboleth.idp.relyingparty.RelyingPartyConfiguration;
-import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
import net.shibboleth.oidc.metadata.context.OIDCProviderMetadataContext;
import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
@@ -70,8 +67,7 @@ public abstract class AbstractOIDCTest {
+ "\"userinfo_endpoint\":\"https://www.certification.openid.net/test/a/test_rp_proxy/userinfo\","
+ "\"registration_endpoint\":\"https://www.certification.openid.net/test/a/test_rp_proxy/register\","
+ "\"scopes_supported\":[\"openid\",\"phone\",\"profile\",\"email\",\"address\",\"offline_access\"],"
- + "\"response_types_supported\":[\"code\",\"id_token code\",\"token code id_token\",\"id_token\","
- + "\"token id_token\",\"token code\",\"token\"],\"response_modes_supported\":[\"query\",\"fragment\","
+ + "\"response_types_supported\":[\"code\"],\"response_modes_supported\":[\"query\",\"fragment\","
+ "\"form_post\"],\"token_endpoint_auth_methods_supported\":[\"client_secret_basic\"],"
+ "\"token_endpoint_auth_signing_alg_values_supported\":[\"RS256\",\"RS384\",\"RS512\","
+ "\"PS256\",\"PS384\",\"PS512\",\"ES256\",\"ES256K\",\"ES384\",\"ES512\",\"EdDSA\"],"
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthorizationControllerTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthorizationControllerTest.java
index ce6044a..df85b5f 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthorizationControllerTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AuthorizationControllerTest.java
@@ -86,12 +86,12 @@ import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.authn.context.ExternalAuthenticationContext;
import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
import net.shibboleth.idp.authn.impl.ExternalAuthenticationImpl;
-import net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.RequestObjectTokenUpdateStrategy;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.OAuth2ClientContext;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.OIDCAuthnContext;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.OIDCPeerEntityContext;
-import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic.JWTClaimsSetFromRequestObjectLookupFunction;
-import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic.PayloadFromRequestObjectLookupFunction;
+import net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate.RequestObjectTokenUpdateStrategy;
+import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.navigate.JWTClaimsSetFromRequestObjectLookupFunction;
+import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.navigate.PayloadFromRequestObjectLookupFunction;
import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.AddStateHandler;
import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.BuildPlainRequestObjectJWT;
import net.shibboleth.idp.plugin.authn.test.flow.mock.IdPPropertyConfigurer;
@@ -339,7 +339,8 @@ public class AuthorizationControllerTest extends AbstractTestNGSpringContextTest
final var sigParams = new SignatureSigningParameters();
sigParams.setSignatureAlgorithm("HS256");
- sigParams.setSigningCredential(TestCredentialHelper.createClientSecretCredential(CLIENT_SECRET));
+ sigParams.setSigningCredential(
+ TestCredentialHelper.createClientSecretCredential(CLIENT_SECRET).toSigningCredential());
secContext.setSignatureSigningParameters(sigParams);
// We only sign, so do not set enc. params
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java
index bd6f1d9..3c4c4c9 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/OIDCRPFlowTest.java
@@ -89,7 +89,7 @@ import net.shibboleth.oidc.security.credential.BasicJWKCredential;
import net.shibboleth.oidc.security.credential.JOSEObjectCredentialResolver;
import net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver;
import net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver;
-import net.shibboleth.oidc.security.credential.impl.CriterionCredentialResolver;
+import net.shibboleth.oidc.security.credential.impl.ClientSecretCriterionCredentialResolver;
import net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine;
import net.shibboleth.oidc.security.jose.impl.BasicDecryptionConfiguration;
import net.shibboleth.oidc.security.jose.impl.BasicSignatureValidationConfiguration;
@@ -105,7 +105,6 @@ import okhttp3.tls.HandshakeCertificates;
import okhttp3.tls.HeldCertificate;
/**
- *
* Test the OIDC relying party flow.
*
* <p>Any test which tests flow execution up to the authentication request controller will use config
@@ -113,7 +112,7 @@ import okhttp3.tls.HeldCertificate;
* request controller will need to setup all required contexts programatically. </p>
*
* <p>Note, the profile configuration which normal exists in oidc-commons i.e.
- * inside the relying-party/postconfig.xml, is in the test resources tree</p>
+ * inside the relying-party/postconfig.xml, is in the test resources tree in the /conf directory.</p>
* */
public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
@@ -336,10 +335,10 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
// Add a signing key incase it is used
loadBeanDefinitionsFromXmlFile(builderContext,
- new ClassPathResource("conf/authn/oidc-rp-credentials.xml"), Map.of(
+ new ClassPathResource("conf/authn/test-oidc-credentials.xml"), Map.of(
"idp.authn.oidc.rp.client.clientId", CLIENT_ID,
"idp.authn.oidc.rp.client.clientSecret",CLIENT_SECRET,
- "idp.authn.oidc.rp.client.sig.key","conf/credentials/idp-signing-rsa.jwk"));
+ "idp.signing.oidc.rs.key","conf/credentials/idp-signing-rsa.jwk"));
}
@@ -418,13 +417,14 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
final var sigValConfig = new BasicSignatureValidationConfiguration();
sigValConfig.setSignatureTrustEngine(
- new ExplicitKeySignedJWTTrustEngine(new CriterionCredentialResolver(),
+ new ExplicitKeySignedJWTTrustEngine(new ClientSecretCriterionCredentialResolver(),
new BasicJOSEObjectCredentialResolver()));
securityConfig.setJwtSignatureValidationConfiguration(sigValConfig);
//The CEK resolver just resolves keys from the criteria set.
final var tokenDecryptConfig = new BasicDecryptionConfiguration();
- tokenDecryptConfig.setContentEncryptionKeyCredentialResolver(new CriterionCredentialResolver());
+ tokenDecryptConfig.setContentEncryptionKeyCredentialResolver(
+ new ClientSecretCriterionCredentialResolver());
securityConfig.setJwtDecryptionConfiguration(tokenDecryptConfig);
return securityConfig;
@@ -873,15 +873,17 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
.getProfileConfig();
partyConfig.setClientCredential(
- TestCredentialHelper.createDirectEncryptionCredentialFromSharedSecret(CLIENT_SECRET));
+ TestCredentialHelper.createClientSecretCredential(CLIENT_SECRET));
// Set a default security config for the profile config
final JSONSecurityConfiguration secConfig = new JSONSecurityConfiguration();
final var idTokenDecryptConfig = new BasicDecryptionConfiguration();
- idTokenDecryptConfig.setContentEncryptionKeyCredentialResolver(new CriterionCredentialResolver());
+ idTokenDecryptConfig.setContentEncryptionKeyCredentialResolver(
+ new ClientSecretCriterionCredentialResolver());
final var decryptConfig = new BasicDecryptionConfiguration();
- decryptConfig.setContentEncryptionKeyCredentialResolver(new CriterionCredentialResolver());
+ decryptConfig.setContentEncryptionKeyCredentialResolver(
+ new ClientSecretCriterionCredentialResolver());
decryptConfig.setKEKCredentialResolver(new JOSEObjectCredentialResolver() {
@Override
@@ -909,7 +911,8 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
new BasicSignatureValidationConfiguration();
sigValidation.setSignatureTrustEngine(
new ExplicitKeySignedJWTTrustEngine(
- new ChainingJOSEObjectCredentialResolver(List.of(new CriterionCredentialResolver(),
+ new ChainingJOSEObjectCredentialResolver(List.of(
+ new ClientSecretCriterionCredentialResolver(),
new JOSEObjectCredentialResolver() {
@Override
@@ -999,7 +1002,8 @@ public class OIDCRPFlowTest extends AbstractAuthnXmlFlowExecutionTests {
final BasicSignatureValidationConfiguration sigValidation =
new BasicSignatureValidationConfiguration();
sigValidation.setSignatureTrustEngine(new ExplicitKeySignedJWTTrustEngine(
- new CriterionCredentialResolver(), new BasicJOSEObjectCredentialResolver()));
+ new ClientSecretCriterionCredentialResolver(),
+ new BasicJOSEObjectCredentialResolver()));
secConfig.setJwtSignatureValidationConfiguration(sigValidation);
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/RelyingPartyProxySigningParametersResolverTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/RelyingPartyProxySigningParametersResolverTest.java
index 975e193..8117a65 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/RelyingPartyProxySigningParametersResolverTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/RelyingPartyProxySigningParametersResolverTest.java
@@ -30,8 +30,6 @@ import java.time.Duration;
import java.util.List;
import java.util.stream.Collectors;
-import javax.crypto.spec.SecretKeySpec;
-
import org.opensaml.core.config.InitializationException;
import org.opensaml.security.credential.UsageType;
import org.opensaml.xmlsec.config.GlobalAlgorithmRegistryInitializer;
@@ -55,12 +53,12 @@ import net.shibboleth.idp.relyingparty.RelyingPartyConfiguration;
import net.shibboleth.oidc.jwa.support.SignatureConstants;
import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
import net.shibboleth.oidc.security.credential.BasicExpiringJWKCredential;
+import net.shibboleth.oidc.security.credential.DefaultClientSecretCredential;
import net.shibboleth.oidc.security.credential.JWKCredential;
-import net.shibboleth.oidc.security.impl.JWSAssemblyUtils;
import net.shibboleth.oidc.security.jose.SignatureSigningParameters;
import net.shibboleth.oidc.security.jose.criterion.ProviderMetadataCriterion;
import net.shibboleth.oidc.security.jose.criterion.SignatureSigningConfigurationCriterion;
-import net.shibboleth.oidc.security.jose.criterion.StaticCredentialCriterion;
+import net.shibboleth.oidc.security.jose.criterion.ClientSecretCredentialCriterion;
import net.shibboleth.oidc.security.jose.impl.BasicSignatureSigningConfiguration;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
import net.shibboleth.utilities.java.support.resolver.ResolverException;
@@ -103,7 +101,8 @@ public class RelyingPartyProxySigningParametersResolverTest extends AbstractOIDC
@Test
public void testResolveSuccess_StaticCredentials() throws ResolverException {
final CriteriaSet criteria = buildCriteria(List.of(SignatureConstants.ALGO_ID_SIGNATURE_HS_256));
- criteria.add(new StaticCredentialCriterion(createClientSecretCredential("atestsecret")));
+ criteria.add(new ClientSecretCredentialCriterion(
+ new DefaultClientSecretCredential("atestsecret")));
final Iterable<SignatureSigningParameters> params = resolver.resolve(criteria);
assertNotNull(params);
assertTrue(params.iterator().hasNext());
@@ -114,7 +113,8 @@ public class RelyingPartyProxySigningParametersResolverTest extends AbstractOIDC
@Test
public void testResolveFail_StaticCredentials_UnsupportedMethod() throws ResolverException {
final CriteriaSet criteria = buildCriteria(List.of(SignatureConstants.ALGO_ID_SIGNATURE_RS_256));
- criteria.add(new StaticCredentialCriterion(createClientSecretCredential("atestsecret")));
+ criteria.add(new ClientSecretCredentialCriterion(
+ new DefaultClientSecretCredential("atestsecret")));
final Iterable<SignatureSigningParameters> params = resolver.resolve(criteria);
assertNotNull(params);
assertFalse(params.iterator().hasNext());
@@ -124,7 +124,8 @@ public class RelyingPartyProxySigningParametersResolverTest extends AbstractOIDC
public void testResolveSuccess_StaticCredentials_ConfigSupportsOne() throws ResolverException {
final CriteriaSet criteria = buildCriteria(List.of(SignatureConstants.ALGO_ID_SIGNATURE_RS_256,
SignatureConstants.ALGO_ID_SIGNATURE_HS_256));
- criteria.add(new StaticCredentialCriterion(createClientSecretCredential("atestsecret")));
+ criteria.add(new ClientSecretCredentialCriterion(
+ new DefaultClientSecretCredential("atestsecret")));;
final Iterable<SignatureSigningParameters> params = resolver.resolve(criteria);
assertNotNull(params);
assertTrue(params.iterator().hasNext());
@@ -136,7 +137,8 @@ public class RelyingPartyProxySigningParametersResolverTest extends AbstractOIDC
public void testResolveSuccess_StaticCredentials_OPSupportsOne() throws ResolverException, URISyntaxException {
final CriteriaSet criteria = buildCriteria(List.of(SignatureConstants.ALGO_ID_SIGNATURE_RS_256,
SignatureConstants.ALGO_ID_SIGNATURE_HS_256));
- criteria.add(new StaticCredentialCriterion(createClientSecretCredential("atestsecret")));
+ criteria.add(new ClientSecretCredentialCriterion(
+ new DefaultClientSecretCredential("atestsecret")));
// Now let the OP support one of those which matches the credential
final OIDCProviderMetadata metadata =
@@ -155,7 +157,8 @@ public class RelyingPartyProxySigningParametersResolverTest extends AbstractOIDC
public void testResolveSuccess_StaticCredentials_OPSupportsNone() throws ResolverException, URISyntaxException {
final CriteriaSet criteria = buildCriteria(List.of(SignatureConstants.ALGO_ID_SIGNATURE_RS_256,
SignatureConstants.ALGO_ID_SIGNATURE_HS_256));
- criteria.add(new StaticCredentialCriterion(createClientSecretCredential("atestsecret")));
+ criteria.add(new ClientSecretCredentialCriterion(
+ new DefaultClientSecretCredential("atestsecret")));
// Now let the OP support none of those supported by the config
final OIDCProviderMetadata metadata =
@@ -174,7 +177,8 @@ public class RelyingPartyProxySigningParametersResolverTest extends AbstractOIDC
SignatureConstants.ALGO_ID_SIGNATURE_HS_256));
// Create the normal client_secret
- criteria.add(new StaticCredentialCriterion(createClientSecretCredential("atestsecret")));
+ criteria.add(new ClientSecretCredentialCriterion(
+ new DefaultClientSecretCredential("atestsecret")));
// Add an RSA type to the security config
final BasicSignatureSigningConfiguration config =
@@ -207,7 +211,8 @@ public class RelyingPartyProxySigningParametersResolverTest extends AbstractOIDC
SignatureConstants.ALGO_ID_SIGNATURE_HS_256, SignatureConstants.ALGO_ID_SIGNATURE_ES_256));
// Create the normal client_secret
- criteria.add(new StaticCredentialCriterion(createClientSecretCredential("atestsecret")));
+ criteria.add(new ClientSecretCredentialCriterion(
+ new DefaultClientSecretCredential("atestsecret")));
// Add an RSA type to the security config
final BasicSignatureSigningConfiguration config =
@@ -240,15 +245,6 @@ public class RelyingPartyProxySigningParametersResolverTest extends AbstractOIDC
return crit;
}
- private JWKCredential createClientSecretCredential(final String secret) {
- final BasicExpiringJWKCredential jwkCredential = new BasicExpiringJWKCredential();
- jwkCredential.setSecretKey(new SecretKeySpec(JWSAssemblyUtils.getSecretBytes(secret), "NONE"));
- jwkCredential.setCredentialExpiresAt(Duration.ZERO);
- jwkCredential.setUsageType(UsageType.UNSPECIFIED);
- jwkCredential.setKid("mockKey");
- jwkCredential.getKeyNames().add("mockKey");
- return jwkCredential;
- }
/**
* Create an AsymmetricJWK credential from the given key.
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/TestCredentialHelper.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/TestCredentialHelper.java
index 4306123..9ce9a3e 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/TestCredentialHelper.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/TestCredentialHelper.java
@@ -30,52 +30,35 @@ import com.nimbusds.jose.jwk.AsymmetricJWK;
import com.nimbusds.jose.jwk.ECKey;
import com.nimbusds.jose.jwk.JWK;
import com.nimbusds.jose.jwk.RSAKey;
-import com.nimbusds.jose.Algorithm;
import net.shibboleth.oidc.security.credential.BasicExpiringJWKCredential;
+import net.shibboleth.oidc.security.credential.ClientSecretCredential;
+import net.shibboleth.oidc.security.credential.DefaultClientSecretCredential;
import net.shibboleth.oidc.security.credential.JWKCredential;
import net.shibboleth.oidc.security.impl.JWSAssemblyUtils;
/** Helper that creates different credentials.*/
+//TODO copy of the sealed one in oidc-crpto-impl
public final class TestCredentialHelper {
private TestCredentialHelper() {
}
- /**
- * Create a simple symmetric key client credential from from the given shared secret.
- *
- * @param secret the secret to convert to a {@link JWKCredential}.
- *
- * @return the credential
- * @throws KeyException on error creating the key
- */
- public static JWKCredential createClientSecretCredential(final String secret) throws KeyException {
- return createClientSecretCredential("mockKey", secret, null);
- }
/**
- * Create a simple symmetric key client credential from from the given shared secret.
+ * Create a simple symmetric key client_secret credential from from the given shared secret.
*
* @param kid the key ID
* @param secret the secret to convert to a {@link JWKCredential}.
* @param algorithm the JWA algorithm to set on the credential.
- *
+ * @param usage TODO
* @return the credential
* @throws KeyException on error creating the key
*/
- public static JWKCredential createClientSecretCredential(final String kid, final String secret,
- final Algorithm algorithm)
+ public static ClientSecretCredential createClientSecretCredential(final String secret)
throws KeyException {
- final BasicExpiringJWKCredential jwkCredential = new BasicExpiringJWKCredential();
- jwkCredential.setSecretKey(KeySupport.decodeSecretKey(JWSAssemblyUtils.getSecretBytes(secret), "AES"));
- jwkCredential.setCredentialExpiresAt(Duration.ZERO);
- jwkCredential.setUsageType(UsageType.UNSPECIFIED);
- jwkCredential.setKid(kid);
- jwkCredential.setAlgorithm(algorithm);
- jwkCredential.getKeyNames().add("mockKey");
- return jwkCredential;
+ return new DefaultClientSecretCredential(secret);
}
/**
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/TestTokenHelper.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/TestTokenHelper.java
index 3cae4e4..ba68509 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/TestTokenHelper.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/TestTokenHelper.java
@@ -48,7 +48,7 @@ import com.nimbusds.jwt.PlainJWT;
import com.nimbusds.jwt.SignedJWT;
import net.shibboleth.oidc.security.credential.JWKCredential;
-import net.shibboleth.oidc.security.credential.impl.JWKCredentialSupport;
+import net.shibboleth.oidc.security.credential.JWKCredentialSupport;
import net.shibboleth.utilities.java.support.collection.Pair;
/** A helper class for generating tokens for testing.*/
@@ -144,11 +144,12 @@ public final class TestTokenHelper {
//client_secret needs to be derived
final JWKCredential derviedCred = JWKCredentialSupport.deriveSymmetricKeyForAlgAndEnc(
- TestCredentialHelper.createClientSecretCredential(clientSecret), JWEAlgorithm.DIR,
- EncryptionMethod.A256GCM);
+ TestCredentialHelper.createClientSecretCredential(clientSecret).toSigningCredential(),
+ JWEAlgorithm.DIR, EncryptionMethod.A256GCM);
final var payload = createBasicClaims("jdoe", "abadnonce", "jdoe", opIssuerId, clientId, audience);
final var signedJWT = new SignedJWT(header,payload);
+ // sign off the client_secret octets directly
signedJWT.sign(new MACSigner(clientSecret));
final JWEObject jweObject =
@@ -159,7 +160,6 @@ public final class TestTokenHelper {
jweObject.encrypt(new DirectEncrypter(derviedCred.getSecretKey()));
final EncryptedJWT jwe = EncryptedJWT.parse(jweObject.serialize());
-
return buildTemplateAccessTokenJSONResponse(jwe.serialize());
}
@@ -203,7 +203,7 @@ public final class TestTokenHelper {
jweObject.encrypt(new RSAEncrypter(keyRecipient.toPublicJWK()));
final EncryptedJWT jwe = EncryptedJWT.parse(jweObject.serialize());
- return new Pair<String, RSAKey>(buildTemplateAccessTokenJSONResponse(jwe.serialize()), keyRecipient);
+ return new Pair<>(buildTemplateAccessTokenJSONResponse(jwe.serialize()), keyRecipient);
}
/**
@@ -235,8 +235,8 @@ public final class TestTokenHelper {
new Payload(keySignedJWTPair.getSecond()));
jweObject.encrypt(new RSAEncrypter(keyRecipient.toPublicJWK()));
- return new Pair<Pair<ECKey, RSAKey>, EncryptedJWT>(
- new Pair<ECKey, RSAKey>(keySignedJWTPair.getFirst(),keyRecipient),
+ return new Pair<>(
+ new Pair<>(keySignedJWTPair.getFirst(),keyRecipient),
EncryptedJWT.parse(jweObject.serialize()));
}
@@ -266,7 +266,7 @@ public final class TestTokenHelper {
final var signedJWT = new SignedJWT(header, payload);
signedJWT.sign(new ECDSASigner(key.toECPrivateKey()));
- return new Pair<ECKey, SignedJWT>(key,signedJWT);
+ return new Pair<>(key,signedJWT);
}
/**
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/TokenResponseIDTokenLookupStrategyTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/TokenResponseIDTokenLookupStrategyTest.java
index 02ada5f..639a6c0 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/TokenResponseIDTokenLookupStrategyTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/TokenResponseIDTokenLookupStrategyTest.java
@@ -13,8 +13,8 @@ import org.testng.annotations.Test;
import com.fasterxml.jackson.core.type.TypeReference;
import com.fasterxml.jackson.databind.ObjectMapper;
-import net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.TokenResponseIDTokenLookupStrategy;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.AccessTokenResponseContext;
+import net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate.TokenResponseIDTokenLookupStrategy;
/** Tests for TokenResponseIDTokenLookupStrategy.*/
public class TokenResponseIDTokenLookupStrategyTest extends AbstractOIDCTest {
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddResponseTypeAndModeHandlerTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddResponseTypeAndModeHandlerTest.java
index 1ecdce6..6f13818 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddResponseTypeAndModeHandlerTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddResponseTypeAndModeHandlerTest.java
@@ -1,7 +1,24 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl;
+
import static org.testng.Assert.assertEquals;
import static org.testng.Assert.assertNotNull;
-import static org.testng.Assert.assertNull;
import org.opensaml.messaging.handler.MessageHandlerException;
import org.testng.annotations.BeforeMethod;
@@ -55,6 +72,24 @@ public class AddResponseTypeAndModeHandlerTest extends AbstractOIDCTest {
(OIDCAuthenticationRequest)prc.getOutboundMessageContext().getMessage()).getResponseType());
}
+ @Test(expectedExceptions = MessageHandlerException.class)
+ public void testResponseTypeNotSupportedByOP() throws Exception {
+
+ oidcAuthzConfig.setResponseType(ResponseType.IDTOKEN.toString());
+ handler.initialize();
+
+ handler.invoke(prc.getOutboundMessageContext());
+ }
+
+ @Test(expectedExceptions = MessageHandlerException.class)
+ public void testResponseModeNotSupportedByOP() throws Exception {
+
+ oidcAuthzConfig.setResponseMode(ResponseMode.JWT.toString());
+ handler.initialize();
+
+ handler.invoke(prc.getOutboundMessageContext());
+ }
+
@Test
public void testResponseModeDefault() throws Exception {
diff --git a/idp-oidc-rp-impl/src/test/resources/conf/authn/oidc-rp-credentials.xml b/idp-oidc-rp-impl/src/test/resources/conf/authn/oidc-rp-credentials.xml
deleted file mode 100644
index 4a925b6..0000000
--- a/idp-oidc-rp-impl/src/test/resources/conf/authn/oidc-rp-credentials.xml
+++ /dev/null
@@ -1,33 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
- xmlns:context="http://www.springframework.org/schema/context"
- xmlns:util="http://www.springframework.org/schema/util" xmlns:p="http://www.springframework.org/schema/p"
- xmlns:c="http://www.springframework.org/schema/c" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-
- default-init-method="initialize" default-destroy-method="destroy">
-
- <!--
- The default credential is based on the client_secret, and will be the only used credential in most cases.
- The algorithm is not specified, this way it supports both 'direct encryption' and key wrapping management modes.
- UsageType is also not specified, this way making the credential also suitable for verifying message authentication codes.
- -->
- <bean id="shibboleth.authn.oidc.rp.DefaultCredential" parent="shibboleth.authn.oidc.rp.ExpiringJWKCredential"
- p:secret="%{idp.authn.oidc.rp.client.clientSecret:#{null}}"
- p:keyNames="%{idp.authn.oidc.rp.client.clientSecretKeyName:defaultPropertiesClientSecret}"/>
-
- <!-- Your RP's default encryption (really decryption) keys, set via property file. -->
- <util:list id="shibboleth.authn.oidc.rp.DefaultKeyEncryptionCredentials">
- <bean parent="shibboleth.authn.oidc.rp.JWKCredential" p:failIfResourceIsNull="false"
- p:resource="%{idp.authn.oidc.rp.client.enc.key:#{null}}" />
- </util:list>
-
- <!-- Default signing credentials -->
- <util:list id="shibboleth.authn.oidc.rp.DefaultSigningCredentials">
- <bean parent="shibboleth.authn.oidc.rp.JWKCredential" p:failIfResourceIsNull="false"
- p:resource="%{idp.authn.oidc.rp.client.sig.key:#{null}}" />
- </util:list>
-
-</beans>
\ No newline at end of file
diff --git a/idp-oidc-rp-impl/src/test/resources/conf/authn/test-oidc-credentials.xml b/idp-oidc-rp-impl/src/test/resources/conf/authn/test-oidc-credentials.xml
new file mode 100644
index 0000000..1db79c1
--- /dev/null
+++ b/idp-oidc-rp-impl/src/test/resources/conf/authn/test-oidc-credentials.xml
@@ -0,0 +1,48 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:context="http://www.springframework.org/schema/context"
+ xmlns:util="http://www.springframework.org/schema/util" xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:c="http://www.springframework.org/schema/c" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+
+ default-init-method="initialize" default-destroy-method="destroy">
+
+ <!-- Factories usually loaded by commons -->
+ <bean id="shibboleth.oidc.ClientSecretCredential" abstract="true"
+ class="net.shibboleth.oidc.security.credential.impl.BasicClientSecretCredentialFactoryBean" />
+
+ <bean id="shibboleth.oidc.JWKCredential" abstract="true"
+ class="net.shibboleth.oidc.security.credential.impl.BasicJWKCredentialFactoryBean" />
+
+ <!--
+ The default credential is based on the client_secret, and will be the only used credential in most cases.
+ -->
+ <bean id="shibboleth.authn.oidc.rp.DefaultCredential" parent="shibboleth.oidc.ClientSecretCredential"
+ p:secret="%{idp.authn.oidc.rp.client.clientSecret:#{null}}"/>
+
+ <bean id="shibboleth.oidc.DefaultRSSigningCredential" parent="shibboleth.oidc.JWKCredential"
+ p:resource="%{idp.signing.oidc.rs.key:#{null}}" p:failIfResourceIsNull="false" />
+
+ <bean id="shibboleth.oidc.DefaultESSigningCredential" parent="shibboleth.oidc.JWKCredential"
+ p:resource="%{idp.signing.oidc.es.key:#{null}}" p:failIfResourceIsNull="false" />
+
+ <bean id="shibboleth.oidc.DefaultRSAEncryptionCredential" parent="shibboleth.oidc.JWKCredential"
+ p:resource="%{idp.signing.oidc.rsa.enc.key:#{null}}" p:failIfResourceIsNull="false" />
+
+ <!-- Your RP's default encryption (really decryption) keys, set via property file. -->
+ <util:list id="shibboleth.oidc.SigningCredentials">
+ <ref bean="shibboleth.oidc.DefaultRSSigningCredential" />
+ <ref bean="shibboleth.oidc.DefaultESSigningCredential" />
+ </util:list>
+
+ <!--
+ Lists ALL of your OP's request decryption credentials for the default security configuration.
+ If you define additional decryption credentials make sure to include them within this list.
+ -->
+ <util:list id="shibboleth.oidc.EncryptionCredentials">
+ <ref bean="shibboleth.oidc.DefaultRSAEncryptionCredential" />
+ </util:list>
+
+</beans>
\ No newline at end of file
diff --git a/idp-oidc-rp-impl/src/test/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-rp-impl/src/test/resources/conf/test-relying-party-postconfig.xml
similarity index 51%
rename from idp-oidc-rp-impl/src/test/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
rename to idp-oidc-rp-impl/src/test/resources/conf/test-relying-party-postconfig.xml
index 5f0fcd0..67fa032 100644
--- a/idp-oidc-rp-impl/src/test/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-rp-impl/src/test/resources/conf/test-relying-party-postconfig.xml
@@ -9,23 +9,52 @@
default-init-method="initialize" default-destroy-method="destroy">
- <!-- OIDC RP and OP Profile Configurations. -->
+ <!-- OIDC RP and OP Profile Configurations. This normally comes from oidc-commons. -->
+
+ <!-- Singleton JWK cache (If the commons is not available, this is needed here) -->
+ <bean id="shibboleth.oidc.RemoteJwkSetCache"
+ class="net.shibboleth.oidc.jwk.RemoteJwkSetCache"
+ p:storage-ref="#{'%{idp.oidc.jwk.StorageService:shibboleth.StorageService}'.trim()}"
+ p:httpClient="#{getObject('shibboleth.oidc.NonBrowser.HttpClient') ?: getObject('shibboleth.InternalHttpClient')}"
+ p:httpClientSecurityParameters="#{getObject('shibboleth.oidc.NonBrowser.HttpClientSecurityParameters')}" />
+ <!--
+ Security Configuration Defaults. These settings establish the default security configurations for
+ signatures and loads the default credentials used.
+ -->
+ <bean id="shibboleth.oidc.BasicSignatureValidationConfiguration" abstract="true"
+ class="net.shibboleth.oidc.security.jose.impl.BasicSignatureValidationConfiguration"
+ p:includedAlgorithms="#{getObject('shibboleth.oidc.IncludedSignatureAlgorithms')}"
+ p:excludedAlgorithms="#{getObject('shibboleth.oidc.ExcludedSignatureAlgorithms')}" />
+
+ <bean id="shibboleth.oidc.BasicSignatureSigningConfiguration" abstract="true"
+ class="net.shibboleth.oidc.security.jose.impl.BasicSignatureSigningConfiguration"
+ p:includedAlgorithms="#{getObject('shibboleth.oidc.IncludedSignatureAlgorithms')}"
+ p:excludedAlgorithms="#{getObject('shibboleth.oidc.ExcludedSignatureAlgorithms')}" />
+
+ <bean id="shibboleth.oidc.BasicEncryptionConfiguration" abstract="true"
+ class="net.shibboleth.oidc.security.jose.impl.BasicEncryptionConfiguration"
+ p:includedAlgorithms="#{getObject('shibboleth.oidc.IncludedEncryptionAlgorithms')}"
+ p:excludedAlgorithms="#{getObject('shibboleth.oidc.ExcludedEncryptionAlgorithms')}" />
+
+ <bean id="shibboleth.oidc.BasicDecryptionConfiguration" abstract="true"
+ class="net.shibboleth.oidc.security.jose.impl.BasicDecryptionConfiguration"
+ p:includedAlgorithms="#{getObject('shibboleth.oidc.IncludedEncryptionAlgorithms')}"
+ p:excludedAlgorithms="#{getObject('shibboleth.oidc.ExcludedEncryptionAlgorithms')}" />
+
<bean id="AbstractOIDCProfile" abstract="true"
- p:securityConfiguration-ref="%{idp.security.authn.oidc.rp.config:shibboleth.authn.oidc.rp.DefaultSecurityConfiguration}" />
+ p:securityConfiguration-ref="%{idp.security.oidc.config:shibboleth.oidc.DefaultSecurityConfiguration}" />
- <bean id="AbstractOIDCSSOProfile" parent="AbstractOIDCProfile" abstract="true"
- p:issuer-ref="issuer"
- p:tokenEndpointAuthMethods="%{idp.authn.oidc.rp.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}"/>
+ <bean id="AbstractOIDCSSOProfile" parent="AbstractOIDCProfile" abstract="true"
+ p:tokenEndpointAuthMethod="%{idp.authn.oidc.rp.client.authenticationMethod:client_secret_basic}"/>
<bean id="OIDC.SSO" parent="AbstractOIDCSSOProfile" lazy-init="true"
class="net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration"
p:httpRequestMethod="%{idp.authn.oidc.rp.httpRequestMethod:GET}"
p:clientId="#{%{idp.authn.oidc.rp.provider.discoveryRequired:false} == true ? null : '%{idp.authn.oidc.rp.client.clientId:}'}"
- p:clientCredential="#{%{idp.authn.oidc.rp.provider.discoveryRequired:false} == true ? {null} : getObject('shibboleth.authn.oidc.rp.DefaultCredential')}"
- p:tokenEndpointAuthMethods="%{idp.authn.oidc.rp.client.authenticationMethod:client_secret_basic}"
+ p:clientCredential="#{%{idp.authn.oidc.rp.provider.discoveryRequired:false} == true ? {null} : getObject('shibboleth.authn.oidc.rp.DefaultCredential')}"
p:responseMode="%{idp.authn.oidc.rp.client.responseMode:#{null}}"
- p:retrieveUserInfoEndpointClaims="%{idp.authn.oidc.rp.client.userinfo.enabled:true}"
+ p:retrieveUserInfoEndpointClaims="%{idp.authn.oidc.rp.client.userinfo.enabled:true}"
p:redirectUriOverride="%{idp.authn.oidc.rp.client.redirectURI:#{null}}"
p:encryptRequestObject="%{idp.authn.oidc.rp.client.requestobject.encrypted:false}"
p:signRequestObject="%{idp.authn.oidc.rp.client.requestobject.signed:true}"
@@ -36,84 +65,115 @@
</property>
<property name="defaultAuthenticationMethodsLookupStrategy">
<bean
- class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassRequestLookupFunction"
- p:mappings="#{getObject('shibboleth.authn.oidc.rp.PrincipalProxyRequestMappings')}" />
+ class="net.shibboleth.oidc.profile.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassRequestLookupFunction"
+ p:mappings="#{getObject('shibboleth.oidc.PrincipalProxyRequestMappings')}" />
</property>
<property name="authenticationContextClassReferenceTranslationStrategyLookupStrategy">
<bean
- class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction$LookupFunctionWrapper">
+ class="net.shibboleth.oidc.profile.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction$LookupFunctionWrapper">
<constructor-arg>
- <bean class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction"
- c:mappings="#{getObject('shibboleth.authn.oidc.rp.PrincipalProxyResponseMappings')}"/>
+ <bean class="net.shibboleth.oidc.profile.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction"
+ c:mappings="#{getObject('shibboleth.oidc.PrincipalProxyResponseMappings')}"/>
</constructor-arg>
</bean>
</property>
<property name="authenticationMethodsReferencesTranslationStrategyLookupStrategy">
<bean
- class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction$LookupFunctionWrapper">
+ class="net.shibboleth.oidc.profile.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction$LookupFunctionWrapper">
<constructor-arg>
- <bean class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction"
- c:mappings="#{getObject('shibboleth.authn.oidc.rp.PrincipalProxyResponseMappings')}"/>
+ <bean class="net.shibboleth.oidc.profile.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction"
+ c:mappings="#{getObject('shibboleth.oidc.PrincipalProxyResponseMappings')}"/>
</constructor-arg>
</bean>
</property>
</bean>
- <!--
- Security Configuration Defaults. These settings establish the default security configurations for
- signatures and loads the default credentials used.
- -->
- <bean id="shibboleth.authn.oidc.rp.BasicSignatureValidationConfiguration" abstract="true"
- class="net.shibboleth.oidc.security.impl.BasicJWTSignatureValidationConfiguration"
- p:includedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.IncludedSignatureAlgorithms')}"
- p:excludedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.ExcludedSignatureAlgorithms')}" />
+ <!-- Keyset profile -->
+ <bean id="OIDC.Keyset" parent="AbstractOIDCProfile" lazy-init="true"
+ class="net.shibboleth.oidc.profile.config.OIDCPublishKeySetConfiguration"
+ p:securityConfiguration-ref="shibboleth.oidc.PublishKeySetSecurityConfiguration" />
+
+ <!-- Configuration for publishing key set. -->
+ <bean id="shibboleth.oidc.PublishKeySetSecurityConfiguration"
+ class="net.shibboleth.oidc.profile.config.JSONSecurityConfiguration">
+ <property name="jwtSignatureSigningConfiguration">
+ <ref bean="shibboleth.oidc.PublishKeySetSigningConfiguration" />
+ </property>
+ <property name="jwtDecryptionConfiguration">
+ <ref bean="shibboleth.oidc.PublishKeySetDecryptionConfiguration" />
+ </property>
+ </bean>
- <bean id="shibboleth.authn.oidc.rp.BasicSignatureSigningConfiguration" abstract="true"
- class="net.shibboleth.oidc.security.impl.BasicJWTSignatureSigningConfiguration"
- p:includedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.IncludedSignatureAlgorithms')}"
- p:excludedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.ExcludedSignatureAlgorithms')}" />
+ <!-- Signing keys to publish. -->
+ <bean id="shibboleth.oidc.PublishKeySetSigningConfiguration"
+ parent="shibboleth.oidc.BasicSignatureSigningConfiguration"
+ p:signingCredentials="#{getObject('shibboleth.oidc.SigningCredentialsToPublish') ?: getObject('shibboleth.oidc.SigningCredentialsFactory')}"/>
- <bean id="shibboleth.authn.oidc.rp.BasicEncryptionConfiguration" abstract="true"
- class="net.shibboleth.oidc.security.impl.BasicJWTEncryptionConfiguration"
- p:includedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.IncludedEncryptionAlgorithms')}"
- p:excludedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.ExcludedEncryptionAlgorithms')}" />
-
- <bean id="shibboleth.authn.oidc.rp.BasicDecryptionConfiguration" abstract="true"
- class="net.shibboleth.oidc.security.impl.BasicJWTDecryptionConfiguration"
- p:includedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.IncludedEncryptionAlgorithms')}"
- p:excludedAlgorithms="#{getObject('shibboleth.authn.oidc.rp.ExcludedEncryptionAlgorithms')}" />
-
+ <!-- Encryption keys to publish. -->
+ <bean id="shibboleth.oidc.PublishKeySetDecryptionConfiguration"
+ parent="shibboleth.oidc.BasicDecryptionConfiguration">
+ <property name="KEKCredentialResolver">
+ <bean id="defaultOIDCKeyDecryptionCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ReturnAllCollectionJOSEObjectCredentialResolver"
+ c:credentials="#{getObject('shibboleth.oidc.EncryptionCredentialsToPublish') ?: getObject('shibboleth.oidc.EncryptionCredentialsToPublishFactory')}"/>
+ </property>
+ </bean>
+
+ <bean id="shibboleth.oidc.EncryptionCredentialsToPublishFactory"
+ class="net.shibboleth.oidc.profile.config.CredentialsListFactory"
+ c:_0="#{getObject('shibboleth.oidc.EncryptionCredentials')}" />
+
- <bean id="shibboleth.authn.oidc.rp.DefaultSecurityConfiguration"
- class="net.shibboleth.oidc.profile.config.OIDCSecurityConfiguration">
+ <bean id="shibboleth.oidc.DefaultSecurityConfiguration"
+ class="net.shibboleth.oidc.profile.config.JSONSecurityConfiguration">
+ <property name="jwtSignatureSigningConfiguration">
+ <ref bean="#{'%{idp.oidc.signing.config:shibboleth.oidc.SigningConfiguration}'.trim()}" />
+ </property>
+ <property name="jwtEncryptionConfiguration">
+ <ref bean="#{'%{idp.oidc.encryption.config:shibboleth.oidc.EncryptionConfiguration}'.trim()}" />
+ </property>
<property name="jwtDecryptionConfiguration">
- <ref
- bean="#{'%{idp.authn.oidc.rp.idtoken.decrypt.config:shibboleth.authn.oidc.rp.DefaultJWTDecryptionConfiguration}'.trim()}" />
+ <ref bean="#{'%{idp.oidc.decryption.config:shibboleth.oidc.DecryptionConfiguration}'.trim()}" />
</property>
<property name="jwtSignatureValidationConfiguration">
- <ref
- bean="#{'%{idp.authn.oidc.rp.idtoken.valid.config:shibboleth.authn.oidc.rp.DefaultJWTSignatureValidationConfiguration}'.trim()}" />
- </property>
- <property name="jwtSignatureSigningConfiguration">
- <ref
- bean="#{'%{idp.authn.oidc.rp.requestobject.signing.config:shibboleth.authn.oidc.rp.DefaultJWTSigningConfiguration}'.trim()}" />
+ <ref bean="#{'%{idp.oidc.validation.config:shibboleth.oidc.SignatureValidationConfiguration}'.trim()}" />
</property>
- <property name="jwtEncryptionConfiguration">
- <ref
- bean="#{'%{idp.authn.oidc.rp.requestobject.encryption.config:shibboleth.authn.oidc.rp.DefaultJWTEncryptionConfiguration}'.trim()}" />
+ </bean>
+
+ <bean id="shibboleth.oidc.SigningConfiguration"
+ parent="shibboleth.oidc.BasicSignatureSigningConfiguration"
+ p:signingCredentials-ref="shibboleth.oidc.SigningCredentialsFactory">
+ <property name="signatureAlgorithms">
+ <list>
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_RS_256" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_RS_384" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_RS_512" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_HS_256" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_HS_384" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_HS_512" />
+ </list>
</property>
</bean>
<!--
- See https://openid.net/specs/openid-connect-core-1_0.html#Encryption. But encryption is either based
+ RequestObject encryption settings.
+
+ See https://openid.net/specs/openid-connect-core-1_0.html#Encryption. Encryption is either based
on published OP keys, or the client_secret, so we can not allow abitrarily configured keys
-->
- <bean id="shibboleth.authn.oidc.rp.DefaultJWTEncryptionConfiguration"
- parent="shibboleth.authn.oidc.rp.BasicEncryptionConfiguration"
- p:KEKCredentialResolver-ref="defaultOIDCRPKeyEncryptionCredentialResolver"
- p:contentEncryptionKeyCredentialResolver-ref="defaultOIDCRPContentEncryptionKeyCredentialResolver">
+ <bean id="shibboleth.oidc.EncryptionConfiguration" parent="shibboleth.oidc.BasicEncryptionConfiguration"
+ p:KEKCredentialResolver-ref="defaultOIDCKeyEncryptionCredentialResolver"
+ p:contentEncryptionKeyCredentialResolver-ref="defaultOIDCContentEncryptionKeyCredentialResolver">
<property name="keyTransportEncryptionAlgorithms">
- <list>
+ <list>
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_RSA_OAEP" />
<util:constant
static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_RSA_1_5" />
<util:constant
@@ -132,154 +192,137 @@
static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_192_GCM_KW" />
<util:constant
static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_256_GCM_KW" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_ECDH_ES" />
</list>
</property>
<property name="dataEncryptionAlgorithms">
- <list>
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A128GCM" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A192GCM" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A256GCM" />
+ <list>
<util:constant
static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A128CBC_HS256" />
<util:constant
static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A192CBC_HS384" />
<util:constant
static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A256CBC_HS512" />
- </list>
- </property>
- </bean>
-
- <bean id="shibboleth.authn.oidc.rp.DefaultJWTSigningConfiguration"
- parent="shibboleth.authn.oidc.rp.BasicSignatureSigningConfiguration"
- p:signingCredentials-ref="shibboleth.authn.oidc.rp.SigningCredentials">
- <property name="signatureAlgorithms">
- <list>
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_RS_256" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_RS_384" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_RS_512" />
<util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_HS_256" />
+ static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A128GCM" />
<util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_HS_384" />
+ static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A192GCM" />
<util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_HS_512" />
+ static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A256GCM" />
</list>
</property>
</bean>
-
- <bean id="shibboleth.authn.oidc.rp.DefaultJWTDecryptionConfiguration"
- parent="shibboleth.authn.oidc.rp.BasicDecryptionConfiguration"
- p:KEKCredentialResolver-ref="defaultOIDCRPKeyDecryptionCredentialResolver"
- p:contentEncryptionKeyCredentialResolver-ref="defaultOIDCRPContentDecryptionKeyCredentialResolver" />
-
-
- <bean id="shibboleth.authn.oidc.rp.SigningCredentials"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.config.CredentialsListFactory"
- c:_0="#{getObject('shibboleth.authn.oidc.rp.DefaultSigningCredentials')}" />
-
- <!--
- A resolver to public/private key encryption keys global to the RP
- -->
- <bean id="defaultOIDCRPKeyDecryptionCredentialResolver"
+ <bean id="shibboleth.oidc.SigningCredentialsFactory"
+ class="net.shibboleth.oidc.profile.config.CredentialsListFactory"
+ c:_0="#{getObject('shibboleth.oidc.SigningCredentials')}" />
+
+ <bean id="defaultOIDCKeyEncryptionCredentialResolver"
class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
<constructor-arg>
<list>
- <bean class="net.shibboleth.oidc.security.credential.impl.LocalJOSEObjectCredentialResolver">
- <constructor-arg name="localCredentialResolver">
- <bean
- class="net.shibboleth.oidc.security.credential.impl.CollectionJOSEObjectCredentialResolver"
- c:credentials-ref="shibboleth.authn.oidc.rp.DefaultKeyEncryptionCredentials" />
- </constructor-arg>
- </bean>
- <bean id="CriterionCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.CriterionCredentialResolver" />
+ <!-- Used by the OP -->
+ <bean id="ClientInformationCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ClientInformationCredentialResolver"
+ p:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache"
+ p:keyFetchInterval="%{idp.oidc.provider.keyfetch.interval:PT30M}"/>
+ <!-- Used by the RP -->
+ <bean id="OIDCProviderMetadataCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ProviderMetadataCredentialResolver"
+ p:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache"
+ p:keyFetchInterval="%{idp.oidc.provider.keyfetch.interval:PT30M}" />
+ <bean id="ClientSecretCriterionCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ClientSecretCriterionCredentialResolver"/>
</list>
</constructor-arg>
</bean>
-
- <!--
- A resolver to resolve a pre-shared Direct Encryption key e.g. a pairwise client_secret from the input criterion
- from which to derive the decryption key.
- -->
- <bean id="defaultOIDCRPContentDecryptionKeyCredentialResolver"
+
+ <bean id="defaultOIDCContentEncryptionKeyCredentialResolver"
class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
<constructor-arg>
<list>
- <bean id="CriterionCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.CriterionCredentialResolver" />
+ <!-- Used by the OP -->
+ <bean id="ClientInformationCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ClientInformationCredentialResolver"
+ p:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache"
+ p:keyFetchInterval="%{idp.oidc.provider.keyfetch.interval:PT30M}"/>
+ <!-- Used by the RP -->
+ <bean id="ClientSecretCriterionCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ClientSecretCriterionCredentialResolver"/>
</list>
</constructor-arg>
+ </bean>
+
+ <bean id="shibboleth.oidc.DecryptionConfiguration"
+ parent="shibboleth.oidc.BasicDecryptionConfiguration"
+ p:KEKCredentialResolver-ref="defaultOIDCKeyDecryptionCredentialResolver"
+ p:contentEncryptionKeyCredentialResolver-ref="defaultOIDCContentDecryptionKeyCredentialResolver">
</bean>
- <!-- A resolver to public key encryption in the OPs metadata alongside the client_secret for key wrapping -->
- <bean id="defaultOIDCRPKeyEncryptionCredentialResolver"
+ <!--
+ A resolver to public/private key encryption keys global to the RP
+ -->
+ <bean id="defaultOIDCKeyDecryptionCredentialResolver"
class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
<constructor-arg>
<list>
- <bean id="OIDCProviderMetadataCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.ProviderMetadataCredentialResolver"
- p:remoteJwkSetCache-ref="shibboleth.authn.oidc.rp.RemoteJwkSetCache"
- p:keyFetchInterval="%{idp.authn.oidc.rp.provider.keyfetch.interval:PT30M}" />
+ <bean class="net.shibboleth.oidc.security.credential.impl.LocalJOSEObjectCredentialResolver">
+ <constructor-arg name="localCredentialResolver">
+ <bean
+ class="net.shibboleth.oidc.security.credential.impl.CollectionJOSEObjectCredentialResolver"
+ c:credentials-ref="shibboleth.oidc.EncryptionCredentials" />
+ </constructor-arg>
+ </bean>
<bean id="CriterionCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.CriterionCredentialResolver" />
+ class="net.shibboleth.oidc.security.credential.impl.ClientSecretCriterionCredentialResolver"/>
</list>
</constructor-arg>
</bean>
-
- <!--
- A resolver to resolve pre-shared Direct Encryption or Key Wrapping credentials based on the
- client_secret in the input criterion. Returns the raw value, even though the key to use
- is a derivative of this key.
- -->
- <bean id="defaultOIDCRPContentEncryptionKeyCredentialResolver"
+
+ <bean id="defaultOIDCContentDecryptionKeyCredentialResolver"
class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
<constructor-arg>
<list>
<bean id="CriterionCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.CriterionCredentialResolver" />
+ class="net.shibboleth.oidc.security.credential.impl.ClientSecretCriterionCredentialResolver"/>
</list>
</constructor-arg>
- </bean>
-
- <bean id="shibboleth.authn.oidc.rp.DefaultJWTSignatureValidationConfiguration"
- parent="shibboleth.authn.oidc.rp.BasicSignatureValidationConfiguration"
- p:signatureTrustEngine-ref="ExplicitKeySignedJWTTrustEngine">
- </bean>
-
- <!-- A resolver for resolving trusted credentials to match against those resolved from the JWT -->
+ </bean>
+
+ <bean id="shibboleth.oidc.SignatureValidationConfiguration"
+ parent="shibboleth.oidc.BasicSignatureValidationConfiguration"
+ p:signatureTrustEngine-ref="ExplicitKeySignedJWTTrustEngine"/>
+
+
+ <bean id="ExplicitKeySignedJWTTrustEngine"
+ class="net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine"
+ c:resolver-ref="defaultSignedJWTTrustedCredentialResolver"
+ c:JOSEObjectResolver-ref="defaultSignedJWTJOSEHeaderCredentialResolver" />
+
+ <!-- A resolver for resolving 'untrusted' credentials out of the JOSE header of JWTs -->
+ <bean id="defaultSignedJWTJOSEHeaderCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver" />
+
+ <!-- A resolver for resolving trusted credentials to match against those resolved from the JWT -->
<bean id="defaultSignedJWTTrustedCredentialResolver"
class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
<constructor-arg>
<list>
+ <!-- Used by the OP -->
+ <bean id="ClientInformationCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ClientInformationCredentialResolver"
+ p:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache"
+ p:keyFetchInterval="%{idp.oidc.provider.keyfetch.interval:PT30M}"/>
+ <!-- Used by the RP -->
<bean id="OIDCProviderMetadataCredentialResolver"
class="net.shibboleth.oidc.security.credential.impl.ProviderMetadataCredentialResolver"
- p:remoteJwkSetCache-ref="shibboleth.authn.oidc.rp.RemoteJwkSetCache"
- p:keyFetchInterval="%{idp.authn.oidc.rp.provider.keyfetch.interval:PT30M}"/>
+ p:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache"
+ p:keyFetchInterval="%{idp.oidc.provider.keyfetch.interval:PT30M}"/>
<bean id="CriterionCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.CriterionCredentialResolver" />
+ class="net.shibboleth.oidc.security.credential.impl.ClientSecretCriterionCredentialResolver"/>
</list>
</constructor-arg>
</bean>
- <!-- A resolver for resolving 'untrusted' credentials out of the JOSE header of JWTs -->
- <bean id="defaultSignedJWTJOSEHeaderCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver" />
-
- <bean id="ExplicitKeySignedJWTTrustEngine"
- class="net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine"
- c:resolver-ref="defaultSignedJWTTrustedCredentialResolver"
- c:JOSEObjectResolver-ref="defaultSignedJWTJOSEHeaderCredentialResolver" />
-
-
</beans>
diff --git a/idp-oidc-rp-impl/src/test/resources/conf/test-relyingparty-resolver-service.xml b/idp-oidc-rp-impl/src/test/resources/conf/test-relyingparty-resolver-service.xml
index bbdd4c1..679c4b9 100644
--- a/idp-oidc-rp-impl/src/test/resources/conf/test-relyingparty-resolver-service.xml
+++ b/idp-oidc-rp-impl/src/test/resources/conf/test-relyingparty-resolver-service.xml
@@ -44,8 +44,8 @@
<!-- <value>%{idp.home}/conf/relying-party.xml</value> <value>%{idp.home}/conf/credentials.xml</value> -->
</util:list>
- <!-- Wildcard import hook for plugins. -->
- <import resource="classpath*:/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml" />
+
+ <import resource="classpath:/conf/test-relying-party-postconfig.xml" />
</beans>
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list