[java-idp-plugin-oidc-config] branch main updated: Add plugin structure and basic shared oidc/oauth configuration
Phil Smart
philip.smart at jisc.ac.uk
Thu Feb 9 17:21:15 UTC 2023
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-config.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-config.git;a=commit;h=2c5a5e8cc0eca25b3fc148039e2edd04a9746a41
The following commit(s) were added to refs/heads/main by this push:
new 2c5a5e8 Add plugin structure and basic shared oidc/oauth configuration
2c5a5e8 is described below
commit 2c5a5e8cc0eca25b3fc148039e2edd04a9746a41
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Thu Feb 9 17:21:09 2023 +0000
Add plugin structure and basic shared oidc/oauth configuration
---
.checkstyle | 7 +
.gitignore | 1 +
checkstyle.xml | 118 ++++++++
pom.xml | 93 ++++++
.../idp/oidc/config/OIDCConfigModule.java | 39 +++
.../idp/oidc/config/OIDCConfigPlugin.java | 51 ++++
.../shibboleth/idp/oidc/config/package-info.java | 22 ++
.../META-INF/net.shibboleth.idp/postconfig.xml | 28 ++
.../idp/service/attribute/registry/postconfig.xml | 25 ++
.../idp/service/relying-party/postconfig.xml | 332 +++++++++++++++++++++
.../oidc/common/config/module.properties | 12 +
.../oidc/common/config/plugin.properties | 8 +
.../services/net.shibboleth.idp.module.IdPModule | 1 +
.../services/net.shibboleth.idp.plugin.IdPPlugin | 1 +
14 files changed, 738 insertions(+)
diff --git a/.checkstyle b/.checkstyle
new file mode 100644
index 0000000..cdc0831
--- /dev/null
+++ b/.checkstyle
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<fileset-config file-format-version="1.2.0" simple-config="true" sync-formatter="false">
+ <fileset name="all" enabled="true" check-config-name="Shibboleth Checkstyle" local="false">
+ <file-match-pattern match-pattern="." include-pattern="true"/>
+ </fileset>
+</fileset-config>
diff --git a/.gitignore b/.gitignore
index 10de8c9..5615e47 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
+.classpath
.DS_Store
*/target
*/test-output
diff --git a/checkstyle.xml b/checkstyle.xml
new file mode 100644
index 0000000..50f9490
--- /dev/null
+++ b/checkstyle.xml
@@ -0,0 +1,118 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE module PUBLIC "-//Puppy Crawl//DTD Check Configuration 1.3//EN" "http://www.puppycrawl.com/dtds/configuration_1_3.dtd">
+
+<!--
+ This configuration file was written by the eclipse-cs plugin configuration editor
+-->
+<!--
+ Checkstyle-Configuration: Shibboleth Checkstyle
+ Description: none
+-->
+<module name="Checker">
+ <property name="severity" value="warning"/>
+ <module name="TreeWalker">
+ <property name="tabWidth" value="4"/>
+ <module name="JavadocMethod"/>
+ <module name="JavadocType">
+ <property name="allowUnknownTags" value="true"/>
+ </module>
+ <module name="JavadocVariable"/>
+ <module name="JavadocStyle">
+ <property name="checkEmptyJavadoc" value="true"/>
+ </module>
+ <module name="ConstantName"/>
+ <module name="LocalFinalVariableName"/>
+ <module name="LocalVariableName"/>
+ <module name="MemberName"/>
+ <module name="MethodName"/>
+ <module name="PackageName"/>
+ <module name="ParameterName"/>
+ <module name="StaticVariableName"/>
+ <module name="TypeName"/>
+ <module name="AvoidStarImport"/>
+ <module name="IllegalImport"/>
+ <module name="RedundantImport"/>
+ <module name="UnusedImports"/>
+ <module name="MethodLength">
+ <property name="max" value="70"/>
+ </module>
+ <module name="ParameterNumber">
+ <property name="max" value="5"/>
+ </module>
+ <module name="EmptyForIteratorPad"/>
+ <module name="MethodParamPad"/>
+ <module name="ModifierOrder"/>
+ <module name="AvoidNestedBlocks"/>
+ <module name="LeftCurly"/>
+ <module name="NeedBraces"/>
+ <module name="RightCurly"/>
+ <module name="EmptyStatement"/>
+ <module name="EqualsHashCode"/>
+ <module name="HiddenField"/>
+ <module name="IllegalInstantiation"/>
+ <module name="InnerAssignment"/>
+ <module name="MissingSwitchDefault"/>
+ <module name="SimplifyBooleanExpression"/>
+ <module name="SimplifyBooleanReturn"/>
+ <module name="FinalClass"/>
+ <module name="HideUtilityClassConstructor"/>
+ <module name="VisibilityModifier"/>
+ <module name="ArrayTypeStyle"/>
+ <module name="UpperEll"/>
+ <module name="AnonInnerLength"/>
+ <module name="EmptyForInitializerPad"/>
+ <module name="CovariantEquals"/>
+ <module name="DefaultComesLast"/>
+ <module name="DeclarationOrder"/>
+ <module name="ExplicitInitialization"/>
+ <module name="FallThrough"/>
+ <module name="IllegalThrows"/>
+ <module name="MultipleVariableDeclarations"/>
+ <module name="PackageDeclaration"/>
+ <module name="ParameterAssignment"/>
+ <module name="ReturnCount">
+ <property name="max" value="8"/>
+ <property name="maxForVoid" value="8"/>
+ </module>
+ <module name="StringLiteralEquality"/>
+ <module name="SuperFinalize"/>
+ <module name="ArrayTrailingComma"/>
+ <module name="UnnecessaryParentheses"/>
+ <module name="MutableException"/>
+ <module name="ThrowsCount">
+ <property name="max" value="3"/>
+ </module>
+ <module name="CyclomaticComplexity"/>
+ <module name="TrailingComment"/>
+ <module name="EqualsAvoidNull"/>
+ <module name="ModifiedControlVariable"/>
+ <module name="FinalParameters">
+ <property name="tokens" value="METHOD_DEF,CTOR_DEF,LITERAL_CATCH"/>
+ </module>
+ <module name="FinalLocalVariable">
+ <property name="tokens" value="PARAMETER_DEF,VARIABLE_DEF"/>
+ <property name="validateEnhancedForLoopVariable" value="true"/>
+ </module>
+ <module name="SuppressionCommentFilter">
+ <property name="offCommentFormat" value="\bCheck[Ss]tyle:\s*([\w|]+)\s+OFF\b"/>
+ <property name="onCommentFormat" value="\bCheck[Ss]tyle:\s*([\w|]+)\s+ON\b"/>
+ <property name="checkFormat" value="$1"/>
+ </module>
+ <module name="MissingJavadocMethod"/>
+ <module name="MissingJavadocPackage"/>
+ <module name="MissingJavadocType"/>
+ <module name="InvalidJavadocPosition"/>
+ </module>
+ <module name="FileTabCharacter"/>
+ <module name="FileLength">
+ <property name="max" value="1000"/>
+ </module>
+ <module name="Header">
+ <property name="header" value="/*\n * Licensed to the University Corporation for Advanced Internet Development,\n * Inc. (UCAID) under one or more contributor license agreements. See the\n * NOTICE file distributed with this work for additional information regarding\n * copyright ownership. The UCAID licenses this file to You under the Apache\n * License, Version 2.0 (the "License"); you may not use this file except in\n * compliance with the License. You may obtain a cop [...]
+ <property name="fileExtensions" value="java"/>
+ </module>
+ <module name="JavadocPackage"/>
+ <module name="LineLength">
+ <property name="max" value="120"/>
+ </module>
+</module>
diff --git a/pom.xml b/pom.xml
new file mode 100644
index 0000000..8a5e96a
--- /dev/null
+++ b/pom.xml
@@ -0,0 +1,93 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+ <modelVersion>4.0.0</modelVersion>
+ <parent>
+ <groupId>net.shibboleth</groupId>
+ <artifactId>parent</artifactId>
+ <version>11.3.5</version>
+ </parent>
+ <groupId>net.shibboleth.idp.oidc</groupId>
+ <artifactId>idp-plugin-oidc-config</artifactId>
+ <version>0.0.1-SNAPSHOT</version>
+ <name>Shibboleth IdP :: Plugins :: OIDC/OAuth Shared Configuration</name>
+ <packaging>jar</packaging>
+ <description>Shibboleth Identity Provider OIDC/OAuth Shared Configuration</description>
+ <properties>
+ <idp.groupId>net.shibboleth.idp</idp.groupId>
+ <idp.version>4.3.0</idp.version>
+ <checkstyle.configLocation>${project.basedir}/checkstyle.xml</checkstyle.configLocation>
+ <automatic.module.name>net.shibboleth.idp.plugin.oidc.config</automatic.module.name>
+ </properties>
+ <repositories>
+ <repository>
+ <id>shib-release</id>
+ <url>https://build.shibboleth.net/nexus/content/groups/public</url>
+ <snapshots>
+ <enabled>false</enabled>
+ </snapshots>
+ </repository>
+ <repository>
+ <id>shib-snapshot</id>
+ <url>https://build.shibboleth.net/nexus/content/repositories/snapshots</url>
+ <releases>
+ <enabled>false</enabled>
+ </releases>
+ </repository>
+ </repositories>
+ <scm>
+ <connection>${shibboleth.scm.connection}java-idp-plugin-oidc-config</connection>
+ <developerConnection>${shibboleth.scm.developerConnection}java-idp-plugin-oidc-config</developerConnection>
+ <url>${shibboleth.scm.url}java-idp-plugin-oidc-config.git</url>
+ </scm>
+ <distributionManagement>
+ <site>
+ <id>site</id>
+ <url>scp:${shibboleth.site.deploy.url}java-idp-plugin-oidc-config/${project.version}/</url>
+ </site>
+ </distributionManagement>
+ <dependencies>
+ <!-- Needed for module/plugin impls. -->
+ <dependency>
+ <groupId>${idp.groupId}</groupId>
+ <artifactId>idp-admin-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${idp.groupId}</groupId>
+ <artifactId>idp-admin-impl</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ </dependencies>
+ <dependencyManagement>
+ <dependencies>
+ <!-- Shibboleth IdP BOM for importing IdP dependencies -->
+ <dependency>
+ <groupId>net.shibboleth.idp</groupId>
+ <artifactId>idp-bom</artifactId>
+ <version>${idp.version}</version>
+ <type>pom</type>
+ <scope>import</scope>
+ </dependency>
+ </dependencies>
+ </dependencyManagement>
+
+ <build>
+ <plugins>
+ <plugin>
+ <groupId>org.apache.maven.plugins</groupId>
+ <artifactId>maven-jar-plugin</artifactId>
+ <configuration>
+ <archive>
+ <index>true</index>
+ <manifestEntries>
+ <Automatic-Module-Name>${automatic.module.name}</Automatic-Module-Name>
+ <Sealed>true</Sealed>
+ </manifestEntries>
+ </archive>
+ </configuration>
+ </plugin>
+ </plugins>
+ </build>
+</project>
diff --git a/src/main/java/net/shibboleth/idp/oidc/config/OIDCConfigModule.java b/src/main/java/net/shibboleth/idp/oidc/config/OIDCConfigModule.java
new file mode 100644
index 0000000..3a504a6
--- /dev/null
+++ b/src/main/java/net/shibboleth/idp/oidc/config/OIDCConfigModule.java
@@ -0,0 +1,39 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.oidc.config;
+
+import java.io.IOException;
+
+import net.shibboleth.idp.module.ModuleException;
+import net.shibboleth.idp.module.impl.PluginIdPModule;
+
+/** OIDC Common module implementation.*/
+public class OIDCConfigModule extends PluginIdPModule {
+
+ /**
+ * Constructor.
+ *
+ * @throws IOException if the property file cannot be loaded
+ * @throws ModuleException if other errors occur
+ */
+ public OIDCConfigModule() throws IOException, ModuleException {
+ super(OIDCConfigModule.class);
+ }
+
+
+}
diff --git a/src/main/java/net/shibboleth/idp/oidc/config/OIDCConfigPlugin.java b/src/main/java/net/shibboleth/idp/oidc/config/OIDCConfigPlugin.java
new file mode 100644
index 0000000..c944cd6
--- /dev/null
+++ b/src/main/java/net/shibboleth/idp/oidc/config/OIDCConfigPlugin.java
@@ -0,0 +1,51 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.oidc.config;
+
+import java.io.IOException;
+import java.util.Collections;
+
+import net.shibboleth.idp.module.IdPModule;
+import net.shibboleth.idp.module.ModuleException;
+import net.shibboleth.idp.plugin.PluginException;
+import net.shibboleth.idp.plugin.impl.FirstPartyIdPPlugin;
+
+public class OIDCConfigPlugin extends FirstPartyIdPPlugin{
+
+
+ /**
+ * Constructor.
+ *
+ * @throws IOException if the properties fail to load
+ * @throws PluginException if other errors occur
+ */
+ public OIDCConfigPlugin() throws IOException, PluginException{
+ super(OIDCConfigPlugin.class);
+ try {
+ final IdPModule module = new OIDCConfigModule();
+ setEnableOnInstall(Collections.singleton(module));
+ setDisableOnRemoval(Collections.singleton(module));
+ } catch (final IOException e) {
+ throw e;
+ } catch (final ModuleException e) {
+ throw new PluginException(e);
+ }
+ }
+
+
+}
diff --git a/src/main/java/net/shibboleth/idp/oidc/config/package-info.java b/src/main/java/net/shibboleth/idp/oidc/config/package-info.java
new file mode 100644
index 0000000..91e8d40
--- /dev/null
+++ b/src/main/java/net/shibboleth/idp/oidc/config/package-info.java
@@ -0,0 +1,22 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Plugin and module information about the OIDC common IdP configuration library.
+ */
+
+package net.shibboleth.idp.oidc.config;
\ No newline at end of file
diff --git a/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
new file mode 100644
index 0000000..245a048
--- /dev/null
+++ b/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:context="http://www.springframework.org/schema/context"
+ xmlns:util="http://www.springframework.org/schema/util" xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:c="http://www.springframework.org/schema/c" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+
+ default-init-method="initialize" default-destroy-method="destroy">
+
+ <!-- Generic OIDC System beans needed for OIDC based extensions to function, loaded after global.xml. -->
+
+ <!-- Credential bean factories -->
+ <bean id="shibboleth.oidc.ClientSecretCredential" abstract="true"
+ class="net.shibboleth.oidc.security.credential.impl.BasicClientSecretCredentialFactoryBean" />
+
+ <bean id="shibboleth.oidc.JWKCredential" abstract="true"
+ class="net.shibboleth.oidc.security.credential.impl.BasicJWKCredentialFactoryBean" />
+
+ <!-- Singleton JWK cache -->
+ <bean id="shibboleth.oidc.RemoteJwkSetCache"
+ class="net.shibboleth.oidc.jwk.RemoteJwkSetCache"
+ p:storage-ref="#{'%{idp.oidc.jwk.StorageService:shibboleth.StorageService}'.trim()}"
+ p:httpClient="#{getObject('shibboleth.oidc.NonBrowser.HttpClient') ?: getObject('shibboleth.InternalHttpClient')}"
+ p:httpClientSecurityParameters="#{getObject('shibboleth.oidc.NonBrowser.HttpClientSecurityParameters')}" />
+
+</beans>
\ No newline at end of file
diff --git a/src/main/resources/META-INF/net/shibboleth/idp/service/attribute/registry/postconfig.xml b/src/main/resources/META-INF/net/shibboleth/idp/service/attribute/registry/postconfig.xml
new file mode 100644
index 0000000..75ffe22
--- /dev/null
+++ b/src/main/resources/META-INF/net/shibboleth/idp/service/attribute/registry/postconfig.xml
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:context="http://www.springframework.org/schema/context"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:c="http://www.springframework.org/schema/c"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+
+ default-init-method="initialize" default-destroy-method="destroy">
+
+ <!-- Necessary for encoder parsing and claims mapping to function. -->
+
+ <bean id="OIDCByteTranscoder"
+ class="net.shibboleth.oidc.attribute.transcoding.impl.OIDCByteAttributeTranscoder" />
+
+ <bean id="OIDCStringTranscoder"
+ class="net.shibboleth.oidc.attribute.transcoding.impl.OIDCStringAttributeTranscoder" />
+
+ <bean id="OIDCScopedStringTranscoder"
+ class="net.shibboleth.oidc.attribute.transcoding.impl.OIDCScopedStringAttributeTranscoder" />
+
+</beans>
diff --git a/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
new file mode 100644
index 0000000..289de0f
--- /dev/null
+++ b/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -0,0 +1,332 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:context="http://www.springframework.org/schema/context"
+ xmlns:util="http://www.springframework.org/schema/util" xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:c="http://www.springframework.org/schema/c" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+
+ default-init-method="initialize" default-destroy-method="destroy">
+
+ <!--
+ Security Configuration Defaults. These settings establish the default security configurations for
+ signatures and loads the default credentials used.
+ -->
+ <bean id="shibboleth.oidc.BasicSignatureValidationConfiguration" abstract="true"
+ class="net.shibboleth.oidc.security.jose.impl.BasicSignatureValidationConfiguration"
+ p:includedAlgorithms="#{getObject('shibboleth.oidc.IncludedSignatureAlgorithms')}"
+ p:excludedAlgorithms="#{getObject('shibboleth.oidc.ExcludedSignatureAlgorithms')}" />
+
+ <bean id="shibboleth.oidc.BasicSignatureSigningConfiguration" abstract="true"
+ class="net.shibboleth.oidc.security.jose.impl.BasicSignatureSigningConfiguration"
+ p:includedAlgorithms="#{getObject('shibboleth.oidc.IncludedSignatureAlgorithms')}"
+ p:excludedAlgorithms="#{getObject('shibboleth.oidc.ExcludedSignatureAlgorithms')}" />
+
+ <bean id="shibboleth.oidc.BasicEncryptionConfiguration" abstract="true"
+ class="net.shibboleth.oidc.security.jose.impl.BasicEncryptionConfiguration"
+ p:includedAlgorithms="#{getObject('shibboleth.oidc.IncludedEncryptionAlgorithms')}"
+ p:excludedAlgorithms="#{getObject('shibboleth.oidc.ExcludedEncryptionAlgorithms')}" />
+
+ <bean id="shibboleth.oidc.BasicDecryptionConfiguration" abstract="true"
+ class="net.shibboleth.oidc.security.jose.impl.BasicDecryptionConfiguration"
+ p:includedAlgorithms="#{getObject('shibboleth.oidc.IncludedEncryptionAlgorithms')}"
+ p:excludedAlgorithms="#{getObject('shibboleth.oidc.ExcludedEncryptionAlgorithms')}" />
+
+ <bean id="AbstractOIDCProfile" abstract="true"
+ p:securityConfiguration-ref="%{idp.security.oidc.config:shibboleth.oidc.DefaultSecurityConfiguration}" />
+
+<!-- p:claimsValidator-ref="DefaultJWTClaimsValidator" -->
+ <bean id="AbstractOIDCSSOProfile" parent="AbstractOIDCProfile" abstract="true"
+ p:issuer="#{getObject('shibboleth.oidc.issuer')}"
+ p:tokenEndpointAuthMethods="%{idp.oidc.tokenEndpointAuthMethods:client_secret_basic,client_secret_poster,client_secret_jwt,private_key_jwt}"
+ p:claimsValidator="#{getObject('shibboleth.oidc.DefaultJWTClaimsValidator')}"
+ p:encryptionOptional="%{idp.oidc.encryptionOptional:true}"
+ p:forcePKCE="%{idp.oidc.forcePKCE:false}"
+ p:allowPKCEPlain="%{idp.oidc.allowPKCEPlain:false}"
+ p:iDTokenLifetime="%{idp.oidc.idToken.defaultLifetime:PT1H}"
+ p:accessTokenType="%{idp.oauth2.accessToken.type:}"
+ p:accessTokenLifetime="%{idp.oidc.accessToken.defaultLifetime:PT10M}"
+ p:refreshTokenLifetime="%{idp.oidc.refreshToken.defaultLifetime:PT2H}"
+ p:alwaysIncludedAttributes="%{idp.oidc.alwaysIncludedAttributes:}"
+ p:tokenEndpointAuthMethod="%{idp.authn.oidc.rp.client.authenticationMethod:client_secret_basic}"
+ p:responseMode="%{idp.authn.oidc.rp.client.responseMode:#{null}}"
+ p:clientId="#{%{idp.authn.oidc.rp.provider.discoveryRequired:false} == true ? null : '%{idp.authn.oidc.rp.client.clientId:}'}"
+ p:clientCredential="#{%{idp.authn.oidc.rp.provider.discoveryRequired:false} == true ? {null} : getObject('shibboleth.authn.oidc.rp.DefaultCredential')}"/>
+
+ <bean id="OIDC.SSO" parent="AbstractOIDCSSOProfile" lazy-init="true"
+ class="net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration"
+ p:authorizeCodeLifetime="%{idp.oidc.authorizeCode.defaultLifetime:PT5M}"
+ p:encodeConsentInTokens="%{idp.oidc.encodeConsentInTokens:false}"
+ p:encodedAttributes="%{idp.oidc.encodedAttributes:%{idp.oidc.embeddedAttributes:}}"
+ p:deniedUserInfoAttributes="%{idp.oidc.deniedUserInfoAttributes:}"
+ p:httpRequestMethod="%{idp.authn.oidc.rp.httpRequestMethod:GET}"
+ p:retrieveUserInfoEndpointClaims="%{idp.authn.oidc.rp.client.userinfo.enabled:true}"
+ p:redirectUriOverride="%{idp.authn.oidc.rp.client.redirectURI:#{null}}"
+ p:encryptRequestObject="%{idp.authn.oidc.rp.client.requestobject.encrypted:false}"
+ p:signRequestObject="%{idp.authn.oidc.rp.client.requestobject.signed:true}"
+ p:useRequestObject="%{idp.authn.oidc.rp.client.requestobject.supported:false}"
+ p:scopes="%{idp.authn.oidc.rp.client.scopes:#{null}}">
+ <property name="forceAuthnPredicate">
+ <bean class="net.shibboleth.idp.saml.profile.config.logic.ProxyAwareForceAuthnPredicate" />
+ </property>
+ <property name="defaultAuthenticationMethodsLookupStrategy">
+ <bean
+ class="net.shibboleth.oidc.profile.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassRequestLookupFunction"
+ p:mappings="#{getObject('shibboleth.oidc.PrincipalProxyRequestMappings')}" />
+ </property>
+ <property name="authenticationContextClassReferenceTranslationStrategyLookupStrategy">
+ <bean
+ class="net.shibboleth.oidc.profile.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction$LookupFunctionWrapper">
+ <constructor-arg>
+ <bean class="net.shibboleth.oidc.profile.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction"
+ c:mappings="#{getObject('shibboleth.oidc.PrincipalProxyResponseMappings')}"/>
+ </constructor-arg>
+ </bean>
+ </property>
+ <property name="authenticationMethodsReferencesTranslationStrategyLookupStrategy">
+ <bean
+ class="net.shibboleth.oidc.profile.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction$LookupFunctionWrapper">
+ <constructor-arg>
+ <bean class="net.shibboleth.oidc.profile.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction"
+ c:mappings="#{getObject('shibboleth.oidc.PrincipalProxyResponseMappings')}"/>
+ </constructor-arg>
+ </bean>
+ </property>
+ </bean>
+
+ <!-- Keyset profile -->
+ <bean id="OIDC.Keyset" parent="AbstractOIDCProfile" lazy-init="true"
+ class="net.shibboleth.oidc.profile.config.OIDCPublishKeySetConfiguration"
+ p:securityConfiguration-ref="shibboleth.oidc.PublishKeySetSecurityConfiguration" />
+
+ <!-- Configuration for publishing key set. -->
+ <bean id="shibboleth.oidc.PublishKeySetSecurityConfiguration"
+ class="net.shibboleth.oidc.profile.config.JSONSecurityConfiguration">
+ <property name="jwtSignatureSigningConfiguration">
+ <ref bean="shibboleth.oidc.PublishKeySetSigningConfiguration" />
+ </property>
+ <property name="jwtDecryptionConfiguration">
+ <ref bean="shibboleth.oidc.PublishKeySetDecryptionConfiguration" />
+ </property>
+ </bean>
+
+ <!-- Signing keys to publish. -->
+ <bean id="shibboleth.oidc.PublishKeySetSigningConfiguration"
+ parent="shibboleth.oidc.BasicSignatureSigningConfiguration"
+ p:signingCredentials="#{getObject('shibboleth.oidc.SigningCredentialsToPublish') ?: getObject('shibboleth.oidc.SigningCredentialsFactory')}"/>
+
+ <!-- Encryption keys to publish. -->
+ <bean id="shibboleth.oidc.PublishKeySetDecryptionConfiguration"
+ parent="shibboleth.oidc.BasicDecryptionConfiguration">
+ <property name="KEKCredentialResolver">
+ <bean id="defaultOIDCKeyDecryptionCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ReturnAllCollectionJOSEObjectCredentialResolver"
+ c:credentials="#{getObject('shibboleth.oidc.EncryptionCredentialsToPublish') ?: getObject('shibboleth.oidc.EncryptionCredentialsToPublishFactory')}"/>
+ </property>
+ </bean>
+
+ <bean id="shibboleth.oidc.EncryptionCredentialsToPublishFactory"
+ class="net.shibboleth.oidc.profile.config.CredentialsListFactory"
+ c:_0="#{getObject('shibboleth.oidc.EncryptionCredentials')}" />
+
+
+ <bean id="shibboleth.oidc.DefaultSecurityConfiguration"
+ class="net.shibboleth.oidc.profile.config.JSONSecurityConfiguration">
+ <property name="jwtSignatureSigningConfiguration">
+ <ref bean="#{'%{idp.oidc.signing.config:shibboleth.oidc.SigningConfiguration}'.trim()}" />
+ </property>
+ <property name="jwtEncryptionConfiguration">
+ <ref bean="#{'%{idp.oidc.encryption.config:shibboleth.oidc.EncryptionConfiguration}'.trim()}" />
+ </property>
+ <property name="jwtDecryptionConfiguration">
+ <ref bean="#{'%{idp.oidc.decryption.config:shibboleth.oidc.DecryptionConfiguration}'.trim()}" />
+ </property>
+ <property name="jwtSignatureValidationConfiguration">
+ <ref bean="#{'%{idp.oidc.validation.config:shibboleth.oidc.SignatureValidationConfiguration}'.trim()}" />
+ </property>
+ </bean>
+
+ <bean id="shibboleth.oidc.SigningConfiguration"
+ parent="shibboleth.oidc.BasicSignatureSigningConfiguration"
+ p:signingCredentials-ref="shibboleth.oidc.SigningCredentialsFactory">
+ <property name="signatureAlgorithms">
+ <list>
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_RS_256" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_RS_384" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_RS_512" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_HS_256" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_HS_384" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_HS_512" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_ES_256" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_ES_384" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_ES_512" />
+ </list>
+ </property>
+ </bean>
+
+ <bean id="shibboleth.oidc.EncryptionConfiguration" parent="shibboleth.oidc.BasicEncryptionConfiguration"
+ p:KEKCredentialResolver-ref="defaultOIDCKeyEncryptionCredentialResolver"
+ p:contentEncryptionKeyCredentialResolver-ref="defaultOIDCContentEncryptionKeyCredentialResolver">
+ <property name="keyTransportEncryptionAlgorithms">
+ <list>
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_RSA_1_5" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_RSA_OAEP" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_RSA_OAEP_256" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_128_KW" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_192_KW" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_256_KW" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_128_GCM_KW" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_192_GCM_KW" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_256_GCM_KW" />
+ </list>
+ </property>
+ <property name="dataEncryptionAlgorithms">
+ <list>
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A128CBC_HS256" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A192CBC_HS384" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A256CBC_HS512" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A128GCM" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A192GCM" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A256GCM" />
+ </list>
+ </property>
+ </bean>
+
+ <bean id="shibboleth.oidc.SigningCredentialsFactory"
+ class="net.shibboleth.oidc.profile.config.CredentialsListFactory"
+ c:_0="#{getObject('shibboleth.oidc.SigningCredentials')}" />
+
+ <bean id="defaultOIDCKeyEncryptionCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
+ <constructor-arg>
+ <list>
+ <!-- Used by the OP -->
+ <bean id="ClientInformationCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ClientInformationCredentialResolver"
+ p:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache"
+ p:keyFetchInterval="%{idp.oidc.provider.keyfetch.interval:PT30M}"/>
+ <!-- Used by the RP -->
+ <bean id="OIDCProviderMetadataCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ProviderMetadataCredentialResolver"
+ p:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache"
+ p:keyFetchInterval="%{idp.oidc.provider.keyfetch.interval:PT30M}" />
+ <bean id="ClientSecretCriterionCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ClientSecretCriterionCredentialResolver"/>
+ </list>
+ </constructor-arg>
+ </bean>
+
+ <bean id="defaultOIDCContentEncryptionKeyCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
+ <constructor-arg>
+ <list>
+ <!-- Used by the OP -->
+ <bean id="ClientInformationCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ClientInformationCredentialResolver"
+ p:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache"
+ p:keyFetchInterval="%{idp.oidc.provider.keyfetch.interval:PT30M}"/>
+ <!-- Used by the RP -->
+ <bean id="ClientSecretCriterionCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ClientSecretCriterionCredentialResolver"/>
+ </list>
+ </constructor-arg>
+ </bean>
+
+ <bean id="shibboleth.oidc.DecryptionConfiguration"
+ parent="shibboleth.oidc.BasicDecryptionConfiguration"
+ p:KEKCredentialResolver-ref="defaultOIDCKeyDecryptionCredentialResolver"
+ p:contentEncryptionKeyCredentialResolver-ref="defaultOIDCContentDecryptionKeyCredentialResolver">
+ </bean>
+
+ <!--
+ A resolver to public/private key encryption keys global to the RP
+ -->
+ <bean id="defaultOIDCKeyDecryptionCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
+ <constructor-arg>
+ <list>
+ <bean class="net.shibboleth.oidc.security.credential.impl.LocalJOSEObjectCredentialResolver">
+ <constructor-arg name="localCredentialResolver">
+ <bean
+ class="net.shibboleth.oidc.security.credential.impl.CollectionJOSEObjectCredentialResolver"
+ c:credentials-ref="shibboleth.oidc.EncryptionCredentials" />
+ </constructor-arg>
+ </bean>
+ <bean id="CriterionCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ClientSecretCriterionCredentialResolver"/>
+ </list>
+ </constructor-arg>
+ </bean>
+
+ <bean id="defaultOIDCContentDecryptionKeyCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
+ <constructor-arg>
+ <list>
+ <bean id="CriterionCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ClientSecretCriterionCredentialResolver"/>
+ </list>
+ </constructor-arg>
+ </bean>
+
+ <bean id="shibboleth.oidc.SignatureValidationConfiguration"
+ parent="shibboleth.oidc.BasicSignatureValidationConfiguration"
+ p:signatureTrustEngine-ref="ExplicitKeySignedJWTTrustEngine"/>
+
+
+ <bean id="ExplicitKeySignedJWTTrustEngine"
+ class="net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine"
+ c:resolver-ref="defaultSignedJWTTrustedCredentialResolver"
+ c:JOSEObjectResolver-ref="defaultSignedJWTJOSEHeaderCredentialResolver" />
+
+ <!-- A resolver for resolving 'untrusted' credentials out of the JOSE header of JWTs -->
+ <bean id="defaultSignedJWTJOSEHeaderCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver" />
+
+ <!-- A resolver for resolving trusted credentials to match against those resolved from the JWT -->
+ <bean id="defaultSignedJWTTrustedCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
+ <constructor-arg>
+ <list>
+ <!-- Used by the OP -->
+ <bean id="ClientInformationCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ClientInformationCredentialResolver"
+ p:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache"
+ p:keyFetchInterval="%{idp.oidc.provider.keyfetch.interval:PT30M}"/>
+ <!-- Used by the RP -->
+ <bean id="OIDCProviderMetadataCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ProviderMetadataCredentialResolver"
+ p:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache"
+ p:keyFetchInterval="%{idp.oidc.provider.keyfetch.interval:PT30M}"/>
+ <bean id="CriterionCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ClientSecretCriterionCredentialResolver"/>
+ </list>
+ </constructor-arg>
+ </bean>
+
+
+</beans>
diff --git a/src/main/resources/META-INF/net/shibboleth/oidc/common/config/module.properties b/src/main/resources/META-INF/net/shibboleth/oidc/common/config/module.properties
new file mode 100644
index 0000000..b77fe3b
--- /dev/null
+++ b/src/main/resources/META-INF/net/shibboleth/oidc/common/config/module.properties
@@ -0,0 +1,12 @@
+# Properties defining this module.
+
+# Class to Module ID mappings
+net.shibboleth.oidc.common.config.idp.OIDCCommonConfigModule = idp.oidc.config.1
+
+# Module Owner
+idp.oidc.config.1.plugin = net.shibboleth.idp.plugin.oidc.config
+
+idp.oidc.config.1.name = Module to provide shared OIDC/OAuth configuration for the IdP
+idp.oidc.config.1.desc = Module to provide shared OIDC/OAuth configuration for IdP plugins to use
+idp.oidc.config.1.url = /OIDCConfig
+
diff --git a/src/main/resources/META-INF/net/shibboleth/oidc/common/config/plugin.properties b/src/main/resources/META-INF/net/shibboleth/oidc/common/config/plugin.properties
new file mode 100644
index 0000000..cbad3f4
--- /dev/null
+++ b/src/main/resources/META-INF/net/shibboleth/oidc/common/config/plugin.properties
@@ -0,0 +1,8 @@
+# Properties defining this plugin
+
+plugin.id = net.shibboleth.idp.plugin.oidc.config
+# Only used when package manifest is not available
+plugin.version = 1.0.0
+
+# No prereqs
+plugin.modules.required = idp.oidc.common.3
diff --git a/src/main/resources/META-INF/services/net.shibboleth.idp.module.IdPModule b/src/main/resources/META-INF/services/net.shibboleth.idp.module.IdPModule
new file mode 100644
index 0000000..91ae79e
--- /dev/null
+++ b/src/main/resources/META-INF/services/net.shibboleth.idp.module.IdPModule
@@ -0,0 +1 @@
+net.shibboleth.idp.oidc.config.OIDCConfigModule
diff --git a/src/main/resources/META-INF/services/net.shibboleth.idp.plugin.IdPPlugin b/src/main/resources/META-INF/services/net.shibboleth.idp.plugin.IdPPlugin
new file mode 100644
index 0000000..a6f4064
--- /dev/null
+++ b/src/main/resources/META-INF/services/net.shibboleth.idp.plugin.IdPPlugin
@@ -0,0 +1 @@
+net.shibboleth.idp.oidc.config.OIDCConfigPlugin
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list