[java-idp-oidc] branch main updated: JCOMOIDC-41 - Move OIDC Signature Validation resolvers and parameter classes to commons
Henri Mikkonen
henri.mikkonen at iki.fi
Fri Jan 6 14:34:23 UTC 2023
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=7d9fc7dfe42a2f8f3c1058ead90006e32638f39a
The following commit(s) were added to refs/heads/main by this push:
new 7d9fc7df JCOMOIDC-41 - Move OIDC Signature Validation resolvers and parameter classes to commons
7d9fc7df is described below
commit 7d9fc7dfe42a2f8f3c1058ead90006e32638f39a
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Jan 6 16:32:03 2023 +0200
JCOMOIDC-41 - Move OIDC Signature Validation resolvers and parameter classes to commons
https://shibboleth.atlassian.net/browse/JCOMOIDC-41
- Switched into using JWT-prefixed properties of OIDCSecurityConfiguration
- Switched into using JWTSecurityParametersContext instead of SecurityParametersContext
- Incoming JWT signature validation now uses TrustEngine (previously JWTSignatureValidationUtil)
- (JWTCredential validator for OAuth2Client, ValidateRequestObject)
- SWF actions related to token signing and encryption features now used from java-oidc-common
- deleted AbstractEncryptTokenAction, EncryptAccessToken, SignAccessToken, AbstractSignJWTAction, EncryptProcessedToken, SignIDToken, SignUserInfoResponse, PopulateOIDCEncryptionParameters, PopulateOIDCSignatureSigningParameters, PopulateOIDCSignatureSigningParametersHandler
- Security parameter resolvers now used from java-oidc-common
- deleted: OIDCClientInformationEncryptionParametersResolver, OIDCClientInformationSignatureSigningParametersResolver, OIDCClientInformationSignatureValidationParametersResolver
---
.../JWTClaimsSetFromIDTokenLookupFunction.java | 63 ++++
...TClaimsSetFromJWTAccessTokenLookupFunction.java | 87 +++++
.../JWTClaimsSetFromUserInfoLookupFunction.java | 65 ++++
.../PayloadFromJWTAccessTokenLookupFunction.java | 82 ++---
.../PayloadFromProcessedTokenLookupFunction.java | 52 +++
.../logic/PayloadFromUserInfoLookupFunction.java | 51 +++
...efaultComputeAuthorizationCodeHashFunction.java | 18 +-
.../navigate/JWTAccessTokenUpdateStrategy.java | 64 ++++
.../navigate/ProcessedTokenUpdateStrategy.java | 45 +++
.../oidc/op/authn/impl/JWTCredentialValidator.java | 31 +-
.../op/criterion/ClientInformationCriterion.java | 55 ---
.../impl/AlgorithmInfoMetadataValueResolver.java | 13 +-
.../profile/impl/AbstractEncryptTokenAction.java | 172 ----------
.../op/oauth2/profile/impl/SignAccessToken.java | 129 -------
.../oauth2/profile/impl/ValidateRequestObject.java | 25 +-
.../impl/AbstractOIDCSigningResponseAction.java | 18 +-
.../op/profile/impl/AbstractSignJWTAction.java | 169 ---------
...bjectSecurityConfigurationToClientMetadata.java | 12 +-
.../AddSecurityConfigurationToClientMetadata.java | 12 +-
.../op/profile/impl/EncryptProcessedToken.java | 62 ----
.../impl/PopulateOIDCEncryptionParameters.java | 301 ----------------
.../PopulateOIDCSignatureSigningParameters.java | 239 -------------
...ulateOIDCSignatureSigningParametersHandler.java | 291 ----------------
.../plugin/oidc/op/profile/impl/SignIDToken.java | 92 -----
...entInformationEncryptionParametersResolver.java | 380 ---------------------
...ormationSignatureSigningParametersResolver.java | 224 ------------
...ationSignatureValidationParametersResolver.java | 307 -----------------
.../plugin/oidc/op/security/impl/package-info.java | 21 --
.../profile/impl/SignUserInfoResponse.java | 120 -------
.../authn/OAuth2Client/OAuth2Client-beans.xml | 50 ++-
.../flows/authn/OAuth2Client/OAuth2Client-flow.xml | 1 +
.../flows/oidc/abstract/oidc-abstract-beans.xml | 13 +-
.../idp/flows/oidc/authorize/authorize-beans.xml | 282 ++++++++++-----
.../idp/flows/oidc/authorize/authorize-flow.xml | 1 +
.../idp/flows/oidc/keyset/keyset-beans.xml | 7 +-
.../idp/flows/oidc/token/token-beans.xml | 253 +++++++++++---
.../idp/flows/oidc/userinfo/userinfo-beans.xml | 112 ++++--
.../idp/service/relying-party/postconfig.xml | 222 +++++++-----
.../op/authn/impl/JWTCredentialValidatorTest.java | 54 +--
.../profile/impl/ValidateRequestObjectTest.java | 82 -----
.../oidc/op/profile/flow/AuthorizeFlowTest.java | 10 +
.../impl/AddAccessTokenHashToIDTokenTest.java | 12 +-
.../AddAuthorizationCodeHashToIDTokenTest.java | 12 +-
...dSecurityConfigurationToClientMetadataTest.java | 16 +-
.../op/profile/impl/EncryptProcessedTokenTest.java | 222 ------------
.../impl/PopulateOIDCEncryptionParametersTest.java | 162 ---------
.../oidc/op/profile/impl/SignIDTokenTest.java | 199 -----------
...nformationEncryptionParametersResolverTest.java | 177 ----------
...tionSignatureSigningParametersResolverTest.java | 216 ------------
...nSignatureValidationParametersResolverTest.java | 269 ---------------
.../profile/impl/SignUserInfoResponseTest.java | 222 ------------
51 files changed, 1215 insertions(+), 4579 deletions(-)
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/logic/JWTClaimsSetFromIDTokenLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/logic/JWTClaimsSetFromIDTokenLookupFunction.java
new file mode 100644
index 00000000..6d830923
--- /dev/null
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/logic/JWTClaimsSetFromIDTokenLookupFunction.java
@@ -0,0 +1,63 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.logic;
+
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.messaging.context.MessageContext;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import com.nimbusds.jwt.JWTClaimsSet;
+import com.nimbusds.oauth2.sdk.ParseException;
+
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
+
+/**
+ * Extract the {@link JWTClaimsSet} from the id_token in {@link OIDCAuthenticationResponseContext}.
+ *
+ * @since 3.4.0
+ */
+public class JWTClaimsSetFromIDTokenLookupFunction implements Function<MessageContext, JWTClaimsSet> {
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(JWTClaimsSetFromIDTokenLookupFunction.class);
+
+ /** {@inheritDoc} */
+ @Override
+ @Nullable public JWTClaimsSet apply(@Nullable final MessageContext messageContext) {
+ if (messageContext == null) {
+ return null;
+ }
+ final OIDCAuthenticationResponseContext oidcResponseCtx =
+ messageContext.getSubcontext(OIDCAuthenticationResponseContext.class);
+ if (oidcResponseCtx == null || oidcResponseCtx.getIDToken() == null) {
+ return null;
+ }
+ try {
+ return oidcResponseCtx.getIDToken().toJWTClaimsSet();
+ } catch (final ParseException e) {
+ log.error("Could not fetch the claims set from ID token", e);
+ }
+ return null;
+ }
+
+}
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/logic/JWTClaimsSetFromJWTAccessTokenLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/logic/JWTClaimsSetFromJWTAccessTokenLookupFunction.java
new file mode 100644
index 00000000..9e32c664
--- /dev/null
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/logic/JWTClaimsSetFromJWTAccessTokenLookupFunction.java
@@ -0,0 +1,87 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.logic;
+
+import java.text.ParseException;
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.messaging.context.MessageContext;
+import org.opensaml.messaging.context.navigate.ChildContextLookup;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import com.nimbusds.jwt.JWTClaimsSet;
+
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.AccessTokenContext;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+
+/**
+ * Extract the {@link JWTClaimsSet} from the JWT in {@link AccessTokenContext}.
+ *
+ * @since 3.4.0
+ */
+public class JWTClaimsSetFromJWTAccessTokenLookupFunction implements Function<MessageContext, JWTClaimsSet> {
+
+ /** Class logger. */
+ @Nonnull private Logger log = LoggerFactory.getLogger(JWTClaimsSetFromJWTAccessTokenLookupFunction.class);
+
+ /** Strategy used to locate the subcontext with the token. */
+ @Nonnull private Function<MessageContext,AccessTokenContext> accessTokenContextLookupStrategy;
+
+ /**
+ * Constructor.
+ */
+ public JWTClaimsSetFromJWTAccessTokenLookupFunction() {
+ // message context -> OIDC response context -> ATC
+ accessTokenContextLookupStrategy = new ChildContextLookup<>(AccessTokenContext.class).compose(
+ new ChildContextLookup<>(OIDCAuthenticationResponseContext.class));
+ }
+
+ /**
+ * Set the strategy used to lookup the {@link AccessTokenContext} to use.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setAccessTokenContextCreationStrategy(
+ @Nonnull final Function<MessageContext,AccessTokenContext> strategy) {
+ accessTokenContextLookupStrategy =
+ Constraint.isNotNull(strategy, "AccessTokenContext lookup strategy cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ @Nullable public JWTClaimsSet apply(@Nullable final MessageContext messageContext) {
+ if (messageContext == null) {
+ return null;
+ }
+ final AccessTokenContext tokenCtx = accessTokenContextLookupStrategy.apply(messageContext);
+ if (tokenCtx == null || tokenCtx.getJWT() == null) {
+ return null;
+ }
+ try {
+ return tokenCtx.getJWT().getJWTClaimsSet();
+ } catch (final ParseException e) {
+ log.error("Could not fetch the claims set from JWT access token", e);
+ }
+ return null;
+ }
+}
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/logic/JWTClaimsSetFromUserInfoLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/logic/JWTClaimsSetFromUserInfoLookupFunction.java
new file mode 100644
index 00000000..229b1756
--- /dev/null
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/logic/JWTClaimsSetFromUserInfoLookupFunction.java
@@ -0,0 +1,65 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.logic;
+
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.messaging.context.MessageContext;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import com.nimbusds.jose.Payload;
+import com.nimbusds.jwt.JWTClaimsSet;
+import com.nimbusds.oauth2.sdk.ParseException;
+
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
+
+/**
+ * Extract the {@link Payload} from the user info in {@link OIDCAuthenticationResponseContext}.
+ *
+ * @since 3.4.0
+ */
+public class JWTClaimsSetFromUserInfoLookupFunction implements Function<MessageContext, JWTClaimsSet>{
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(JWTClaimsSetFromUserInfoLookupFunction.class);
+
+ /** {@inheritDoc} */
+ @Override
+ @Nullable public JWTClaimsSet apply(@Nullable final MessageContext messageContext) {
+ if (messageContext == null) {
+ return null;
+ }
+ final OIDCAuthenticationResponseContext oidcResponseCtx =
+ messageContext.getSubcontext(OIDCAuthenticationResponseContext.class);
+ if (oidcResponseCtx == null || oidcResponseCtx.getUserInfo() == null) {
+ return null;
+ }
+ try {
+ return oidcResponseCtx.getUserInfo().toJWTClaimsSet();
+ } catch (final ParseException e) {
+ log.error("Could not fetch the claims set from UserInfo response", e);
+ }
+ return null;
+ }
+
+}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/EncryptAccessToken.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/logic/PayloadFromJWTAccessTokenLookupFunction.java
similarity index 50%
rename from idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/EncryptAccessToken.java
rename to idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/logic/PayloadFromJWTAccessTokenLookupFunction.java
index 72949c67..e6c7f784 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/EncryptAccessToken.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/logic/PayloadFromJWTAccessTokenLookupFunction.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.logic;
import java.text.ParseException;
import java.util.function.Function;
@@ -23,99 +23,71 @@ import java.util.function.Function;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
-import org.opensaml.profile.action.ActionSupport;
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.profile.context.navigate.OutboundMessageContextLookup;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import com.nimbusds.jose.Payload;
-import com.nimbusds.jwt.EncryptedJWT;
import com.nimbusds.jwt.PlainJWT;
import com.nimbusds.jwt.SignedJWT;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.AccessTokenContext;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
-import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
-/**
- * Action that handles JWT access token encryption.
+/**
+ * Extract the {@link Payload} from the JWT in {@link AccessTokenContext}.
+ *
+ * @since 3.4.0
*/
-public class EncryptAccessToken extends AbstractEncryptTokenAction {
+public class PayloadFromJWTAccessTokenLookupFunction implements Function<MessageContext, Payload> {
/** Class logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(EncryptAccessToken.class);
+ @Nonnull private Logger log = LoggerFactory.getLogger(PayloadFromJWTAccessTokenLookupFunction.class);
/** Strategy used to locate the subcontext with the token. */
- @Nonnull private Function<ProfileRequestContext,AccessTokenContext> accessTokenContextLookupStrategy;
-
- /** Token context. */
- @Nullable private AccessTokenContext tokenCtx;
+ @Nonnull private Function<MessageContext,AccessTokenContext> accessTokenContextLookupStrategy;
- /** Constructor. */
- public EncryptAccessToken() {
- // PRC -> outbound message context -> OIDC response context -> ATC
+ /**
+ * Constructor.
+ */
+ public PayloadFromJWTAccessTokenLookupFunction() {
+ // message context -> OIDC response context -> ATC
accessTokenContextLookupStrategy = new ChildContextLookup<>(AccessTokenContext.class).compose(
- new ChildContextLookup<>(OIDCAuthenticationResponseContext.class).compose(
- new OutboundMessageContextLookup()));
+ new ChildContextLookup<>(OIDCAuthenticationResponseContext.class));
}
-
+
/**
- * Set the strategy used to create the {@link AccessTokenContext} to use.
+ * Set the strategy used to lookup the {@link AccessTokenContext} to use.
*
- * @param strategy creation strategy
+ * @param strategy lookup strategy
*/
public void setAccessTokenContextCreationStrategy(
- @Nonnull final Function<ProfileRequestContext,AccessTokenContext> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
+ @Nonnull final Function<MessageContext,AccessTokenContext> strategy) {
accessTokenContextLookupStrategy =
Constraint.isNotNull(strategy, "AccessTokenContext lookup strategy cannot be null");
}
- /** {@inheritDoc} */
@Override
- protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
-
- if (!super.doPreExecute(profileRequestContext)) {
- return false;
+ @Nullable public Payload apply(@Nullable final MessageContext messageContext) {
+ if (messageContext == null) {
+ return null;
}
-
- tokenCtx = accessTokenContextLookupStrategy.apply(profileRequestContext);
- if (tokenCtx == null) {
- log.error("{} AccessTokenContext is missing", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
- return false;
+ final AccessTokenContext tokenCtx = accessTokenContextLookupStrategy.apply(messageContext);
+ if (tokenCtx == null || tokenCtx.getJWT() == null) {
+ return null;
}
-
- return true;
- }
-
- /** {@inheritDoc} */
- @Override
- protected Payload getPayload(@Nonnull final ProfileRequestContext profileRequestContext) {
-
if (tokenCtx.getJWT() instanceof SignedJWT) {
return new Payload((SignedJWT) tokenCtx.getJWT());
} else if (tokenCtx.getJWT() instanceof PlainJWT) {
try {
return new Payload(tokenCtx.getJWT().getJWTClaimsSet().getClaims());
} catch (final ParseException e) {
- log.error("{} Unable to convert plaintext JWT to claims set", getLogPrefix(), e);
+ log.error("Unable to convert plaintext JWT to claims set", e);
}
}
-
return null;
}
- /** {@inheritDoc} */
- @Override
- protected void setProcessedToken(@Nonnull final ProfileRequestContext profileRequestContext,
- @Nonnull final EncryptedJWT token) {
- tokenCtx.setJWT(token);
- }
-
-}
\ No newline at end of file
+}
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/logic/PayloadFromProcessedTokenLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/logic/PayloadFromProcessedTokenLookupFunction.java
new file mode 100644
index 00000000..9b2a0e98
--- /dev/null
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/logic/PayloadFromProcessedTokenLookupFunction.java
@@ -0,0 +1,52 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.logic;
+
+import java.util.function.Function;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.messaging.context.MessageContext;
+
+import com.nimbusds.jose.Payload;
+import com.nimbusds.jwt.SignedJWT;
+
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
+
+/**
+ * Extract the {@link Payload} from the processed token in {@link OIDCAuthenticationResponseContext}.
+ *
+ * @since 3.4.0
+ */
+public class PayloadFromProcessedTokenLookupFunction implements Function<MessageContext, Payload>{
+
+ @Override
+ @Nullable public Payload apply(@Nullable final MessageContext messageContext) {
+ if (messageContext == null) {
+ return null;
+ }
+ final OIDCAuthenticationResponseContext oidcResponseCtx =
+ messageContext.getSubcontext(OIDCAuthenticationResponseContext.class);
+ if (oidcResponseCtx == null || oidcResponseCtx.getProcessedToken() == null) {
+ return null;
+ }
+ return new Payload((SignedJWT) oidcResponseCtx.getProcessedToken());
+ }
+
+}
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/logic/PayloadFromUserInfoLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/logic/PayloadFromUserInfoLookupFunction.java
new file mode 100644
index 00000000..3202f9a1
--- /dev/null
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/logic/PayloadFromUserInfoLookupFunction.java
@@ -0,0 +1,51 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.logic;
+
+import java.util.function.Function;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.messaging.context.MessageContext;
+
+import com.nimbusds.jose.Payload;
+
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
+
+/**
+ * Extract the {@link Payload} from the user info in {@link OIDCAuthenticationResponseContext}.
+ *
+ * @since 3.4.0
+ */
+public class PayloadFromUserInfoLookupFunction implements Function<MessageContext, Payload>{
+
+ @Override
+ @Nullable public Payload apply(@Nullable final MessageContext messageContext) {
+ if (messageContext == null) {
+ return null;
+ }
+ final OIDCAuthenticationResponseContext oidcResponseCtx =
+ messageContext.getSubcontext(OIDCAuthenticationResponseContext.class);
+ if (oidcResponseCtx == null || oidcResponseCtx.getUserInfo() == null) {
+ return null;
+ }
+ return new Payload(oidcResponseCtx.getUserInfo().toJSONObject());
+ }
+
+}
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultComputeAuthorizationCodeHashFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultComputeAuthorizationCodeHashFunction.java
index d8ed9175..c2e54cdd 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultComputeAuthorizationCodeHashFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultComputeAuthorizationCodeHashFunction.java
@@ -24,8 +24,6 @@ import javax.annotation.Nullable;
import org.opensaml.messaging.context.navigate.ContextDataLookupFunction;
import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.xmlsec.SignatureSigningParameters;
-import org.opensaml.xmlsec.context.SecurityParametersContext;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -33,6 +31,8 @@ import com.nimbusds.jose.JWSAlgorithm;
import com.nimbusds.oauth2.sdk.AuthorizationCode;
import com.nimbusds.openid.connect.sdk.claims.CodeHash;
+import net.shibboleth.oidc.security.JWTSignatureSigningParameters;
+import net.shibboleth.oidc.security.context.JWTSecurityParametersContext;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
import net.shibboleth.utilities.java.support.component.AbstractIdentifiableInitializableComponent;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
@@ -42,7 +42,7 @@ import net.shibboleth.utilities.java.support.primitive.StringSupport;
/**
* A function that computes a hash value for the authorization code via required configurable lookup function.
- * The signature signing algorithm found in the {@link SecurityParametersContext} is used for calculating the hash.
+ * The signature signing algorithm found in the {@link JWTSecurityParametersContext} is used for calculating the hash.
* The lookup function for the security parameters context is required to be set.
*
* @since 3.2.0
@@ -54,21 +54,21 @@ public class DefaultComputeAuthorizationCodeHashFunction extends AbstractIdentif
@Nonnull private Logger log = LoggerFactory.getLogger(DefaultComputeAuthorizationCodeHashFunction.class);
/**
- * Strategy used to locate the {@link SecurityParametersContext} to use for calculating the code hash.
+ * Strategy used to locate the {@link JWTSecurityParametersContext} to use for calculating the code hash.
*/
@NonnullAfterInit
- private Function<ProfileRequestContext, SecurityParametersContext> securityParametersLookupStrategy;
+ private Function<ProfileRequestContext, JWTSecurityParametersContext> securityParametersLookupStrategy;
/** Strategy used to locate the raw authorization code value (as {@link String}) to use for calculating the hash. */
@NonnullAfterInit private Function<ProfileRequestContext, String> authorizationCodeLookupStrategy;
/**
- * Set the strategy used to locate the {@link SecurityParametersContext} to use.
+ * Set the strategy used to locate the {@link JWTSecurityParametersContext} to use.
*
* @param strategy lookup strategy
*/
public void setSecurityParametersLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, SecurityParametersContext> strategy) {
+ @Nonnull final Function<ProfileRequestContext, JWTSecurityParametersContext> strategy) {
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
securityParametersLookupStrategy =
@@ -110,12 +110,12 @@ public class DefaultComputeAuthorizationCodeHashFunction extends AbstractIdentif
return null;
}
final AuthorizationCode code = new AuthorizationCode(rawCode);
- final SecurityParametersContext securityParameters = securityParametersLookupStrategy.apply(input);
+ final JWTSecurityParametersContext securityParameters = securityParametersLookupStrategy.apply(input);
if (securityParameters == null || securityParameters.getSignatureSigningParameters() == null) {
log.error("Could not resolve security parameters for calculating the code hash value");
return null;
}
- final SignatureSigningParameters signingParameters = securityParameters.getSignatureSigningParameters();
+ final JWTSignatureSigningParameters signingParameters = securityParameters.getSignatureSigningParameters();
final CodeHash cHash = CodeHash.compute(code, new JWSAlgorithm(signingParameters.getSignatureAlgorithm()),
null);
if (cHash == null || cHash.getValue() == null) {
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/JWTAccessTokenUpdateStrategy.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/JWTAccessTokenUpdateStrategy.java
new file mode 100644
index 00000000..81316fb9
--- /dev/null
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/JWTAccessTokenUpdateStrategy.java
@@ -0,0 +1,64 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+
+import java.util.function.BiConsumer;
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.messaging.context.MessageContext;
+import org.opensaml.messaging.context.navigate.ChildContextLookup;
+
+import com.nimbusds.jwt.JWT;
+
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.AccessTokenContext;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
+
+/**
+ * Add the {@link JWT} back to the {@link AccessTokenContext}.
+ *
+ * @since 3.4.0
+ */
+public class JWTAccessTokenUpdateStrategy implements BiConsumer<JWT, MessageContext> {
+
+ /** Strategy used to locate the subcontext with the token. */
+ @Nonnull private Function<MessageContext,AccessTokenContext> accessTokenContextLookupStrategy;
+
+ /**
+ * Constructor.
+ */
+ public JWTAccessTokenUpdateStrategy() {
+ // message context -> OIDC response context -> ATC
+ accessTokenContextLookupStrategy = new ChildContextLookup<>(AccessTokenContext.class).compose(
+ new ChildContextLookup<>(OIDCAuthenticationResponseContext.class));
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public void accept(final JWT jwt, final MessageContext messageContext) {
+ if (messageContext == null) {
+ return;
+ }
+ final AccessTokenContext tokenCtx = accessTokenContextLookupStrategy.apply(messageContext);
+ if (tokenCtx == null) {
+ return;
+ }
+ tokenCtx.setJWT(jwt);
+ }
+}
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ProcessedTokenUpdateStrategy.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ProcessedTokenUpdateStrategy.java
new file mode 100644
index 00000000..f2040e35
--- /dev/null
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ProcessedTokenUpdateStrategy.java
@@ -0,0 +1,45 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+
+import java.util.function.BiConsumer;
+
+import org.opensaml.messaging.context.MessageContext;
+
+import com.nimbusds.jwt.JWT;
+
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
+
+/**
+ * Add the {@link JWT} back to the processed token in the {@link OIDCAuthenticationResponseContext}.
+ *
+ * @since 3.4.0
+ */
+public class ProcessedTokenUpdateStrategy implements BiConsumer<JWT, MessageContext> {
+
+ /** {@inheritDoc} */
+ @Override
+ public void accept(final JWT jwt, final MessageContext messageContext) {
+ if (messageContext == null || messageContext.getSubcontext(OIDCAuthenticationResponseContext.class) == null) {
+ return;
+ }
+ final OIDCAuthenticationResponseContext oidcResponseCtx =
+ messageContext.getSubcontext(OIDCAuthenticationResponseContext.class);
+ oidcResponseCtx.setProcessedToken(jwt);
+ }
+}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/authn/impl/JWTCredentialValidator.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/authn/impl/JWTCredentialValidator.java
index 03db10f7..8d3bdbde 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/authn/impl/JWTCredentialValidator.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/authn/impl/JWTCredentialValidator.java
@@ -30,11 +30,10 @@ import net.shibboleth.idp.authn.AuthnEventIds;
import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.authn.principal.UsernamePrincipal;
import net.shibboleth.oidc.authn.context.OAuth2ClientAuthenticationContext;
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
import net.shibboleth.oidc.jwt.claims.JWTValidationException;
import net.shibboleth.oidc.profile.config.navigate.ClaimsValidatorLookupFunction;
-import net.shibboleth.oidc.security.impl.JWTSignatureValidationUtil;
+import net.shibboleth.oidc.security.context.JWTSecurityParametersContext;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.annotation.constraint.ThreadSafeAfterInit;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
@@ -42,7 +41,7 @@ import net.shibboleth.utilities.java.support.logic.Constraint;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.xmlsec.context.SecurityParametersContext;
+import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -69,8 +68,8 @@ public class JWTCredentialValidator extends AbstractCredentialValidator {
/** Strategy that will return {@link OAuth2ClientAuthenticationContext}. */
@Nonnull private Function<ProfileRequestContext,OAuth2ClientAuthenticationContext> clientAuthContextLookupStrategy;
- /** Strategy used to locate the {@link SecurityParametersContext} to use for verification. */
- @Nonnull private Function<ProfileRequestContext,SecurityParametersContext> securityParametersLookupStrategy;
+ /** Strategy used to locate the {@link JWTSecurityParametersContext} to use for verification. */
+ @Nonnull private Function<ProfileRequestContext,JWTSecurityParametersContext> securityParametersLookupStrategy;
/** Strategy used to obtain {@link ClaimsValidator}. */
@Nonnull private Function<ProfileRequestContext,ClaimsValidator> claimsValidatorLookupStrategy;
@@ -83,9 +82,9 @@ public class JWTCredentialValidator extends AbstractCredentialValidator {
// PRC -> AuthenticationContext -> OAuth2ClientAuthenticationContext
clientAuthContextLookupStrategy = new ChildContextLookup<>(OAuth2ClientAuthenticationContext.class).compose(
new ChildContextLookup<>(AuthenticationContext.class));
- // PRC -> RP -> SPC
- securityParametersLookupStrategy = new ChildContextLookup<>(SecurityParametersContext.class).compose(
- new ChildContextLookup<>(RelyingPartyContext.class));
+ // PRC -> INBOUND -> SPC
+ securityParametersLookupStrategy = new ChildContextLookup<>(JWTSecurityParametersContext.class).compose(
+ new InboundMessageContextLookup());
claimsValidatorLookupStrategy = new ClaimsValidatorLookupFunction();
}
@@ -109,7 +108,7 @@ public class JWTCredentialValidator extends AbstractCredentialValidator {
* @param strategy lookup strategy
*/
public void setSecurityParametersLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,SecurityParametersContext> strategy) {
+ @Nonnull final Function<ProfileRequestContext,JWTSecurityParametersContext> strategy) {
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
securityParametersLookupStrategy =
@@ -176,20 +175,8 @@ public class JWTCredentialValidator extends AbstractCredentialValidator {
}
throw e;
}
-
+
final JWTAuthentication jwtAuth = (JWTAuthentication) clientAuth;
- final String errorEventId = JWTSignatureValidationUtil.validateSignature(
- securityParametersLookupStrategy.apply(profileRequestContext), jwtAuth.getClientAssertion(),
- AuthnEventIds.INVALID_CREDENTIALS);
- if (errorEventId != null) {
- log.info("{} Login by '{}' failed", getLogPrefix(), clientAuth.getClientID());
- final LoginException e = new LoginException(errorEventId);
- if (errorHandler != null) {
- errorHandler.handleError(profileRequestContext, authenticationContext, e,
- AuthnEventIds.INVALID_CREDENTIALS);
- }
- throw e;
- }
try {
validateJWTClaims(profileRequestContext, jwtAuth.getClientAssertion(), clientAuth.getClientID());
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/criterion/ClientInformationCriterion.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/criterion/ClientInformationCriterion.java
deleted file mode 100644
index a9d480f6..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/criterion/ClientInformationCriterion.java
+++ /dev/null
@@ -1,55 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.criterion;
-
-import javax.annotation.Nonnull;
-
-import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
-
-import net.shibboleth.idp.plugin.oidc.op.security.impl.OIDCClientInformationSignatureSigningParametersResolver;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.resolver.Criterion;
-
-/**
- * Client information criterion to make decisions based on client information. Usually used by
- * {@link OIDCClientInformationSignatureSigningParametersResolver}.
- */
-public class ClientInformationCriterion implements Criterion {
-
- /** Client information. */
- @Nonnull private OIDCClientInformation oidcClientInformation;
-
- /**
- * Constructor.
- *
- * @param information client information
- */
- public ClientInformationCriterion(@Nonnull final OIDCClientInformation information) {
- oidcClientInformation = Constraint.isNotNull(information, "client information cannot be null");
- }
-
- /**
- * Get client information.
- *
- * @return client information
- */
- @Nonnull public OIDCClientInformation getOidcClientInformation() {
- return oidcClientInformation;
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/metadata/impl/AlgorithmInfoMetadataValueResolver.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/metadata/impl/AlgorithmInfoMetadataValueResolver.java
index 58861b54..d3c2374f 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/metadata/impl/AlgorithmInfoMetadataValueResolver.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/metadata/impl/AlgorithmInfoMetadataValueResolver.java
@@ -35,6 +35,9 @@ import org.slf4j.LoggerFactory;
import net.shibboleth.idp.plugin.oidc.op.metadata.resolver.MetadataValueResolver;
import net.shibboleth.idp.profile.config.SecurityConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.oidc.profile.config.OIDCSecurityConfiguration;
+import net.shibboleth.oidc.security.JWTEncryptionConfiguration;
+import net.shibboleth.oidc.security.JWTSignatureSigningConfiguration;
import net.shibboleth.utilities.java.support.component.AbstractIdentifiableInitializableComponent;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
@@ -125,9 +128,15 @@ public class AlgorithmInfoMetadataValueResolver extends AbstractIdentifiableInit
return result;
}
+ if (!(securityConfig instanceof OIDCSecurityConfiguration)) {
+ log.warn("Security configuration class was not expected: {}", securityConfig);
+ return result;
+ }
+ final OIDCSecurityConfiguration oidcSecurityConfig = (OIDCSecurityConfiguration) securityConfig;
+
final List<String> algorithms;
if (resolveEncryptionAlgs) {
- final EncryptionConfiguration encryptionConfig = securityConfig.getEncryptionConfiguration();
+ final JWTEncryptionConfiguration encryptionConfig = oidcSecurityConfig.getJwtEncryptionConfiguration();
if (encryptionConfig != null) {
if (resolveKeyTransportEncAlgs) {
algorithms = encryptionConfig.getKeyTransportEncryptionAlgorithms();
@@ -138,7 +147,7 @@ public class AlgorithmInfoMetadataValueResolver extends AbstractIdentifiableInit
algorithms = new ArrayList<String>();
}
} else {
- final SignatureSigningConfiguration signingConfig = securityConfig.getSignatureSigningConfiguration();
+ final JWTSignatureSigningConfiguration signingConfig = oidcSecurityConfig.getJwtSignatureSigningConfiguration();
if (signingConfig != null) {
algorithms = signingConfig.getSignatureAlgorithms();
} else {
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/AbstractEncryptTokenAction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/AbstractEncryptTokenAction.java
deleted file mode 100644
index 98a0486a..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/AbstractEncryptTokenAction.java
+++ /dev/null
@@ -1,172 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl;
-
-import java.security.interfaces.ECPublicKey;
-import java.security.interfaces.RSAPublicKey;
-import java.text.ParseException;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
-import org.opensaml.profile.action.ActionSupport;
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.saml.saml2.profile.context.EncryptionContext;
-import org.opensaml.security.credential.Credential;
-import org.opensaml.xmlsec.EncryptionParameters;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import com.nimbusds.jose.EncryptionMethod;
-import com.nimbusds.jose.JOSEException;
-import com.nimbusds.jose.JWEAlgorithm;
-import com.nimbusds.jose.JWEHeader;
-import com.nimbusds.jose.JWEObject;
-import com.nimbusds.jose.Payload;
-import com.nimbusds.jose.crypto.AESEncrypter;
-import com.nimbusds.jose.crypto.ECDHEncrypter;
-import com.nimbusds.jose.crypto.RSAEncrypter;
-import com.nimbusds.jwt.EncryptedJWT;
-
-import net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCResponseAction;
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.oidc.security.impl.CredentialConversionUtil;
-import net.shibboleth.utilities.java.support.component.ComponentSupport;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-
-/**
- * Action that encrypts a source object into an {@link EncryptedJWT}.
- *
- * <p> The existence of encryption parameters is used to decide whether the encryption should take place.
- *
- * @since 3.1.0
- */
-public abstract class AbstractEncryptTokenAction extends AbstractOIDCResponseAction {
-
- /** Class logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(AbstractEncryptTokenAction.class);
-
- /** Strategy used to look up the {@link EncryptionContext} to store parameters in. */
- @Nonnull private Function<ProfileRequestContext,EncryptionContext> encryptionContextLookupStrategy;
-
- /** Encryption parameters for encrypting payload. */
- @Nullable private EncryptionParameters params;
-
- /**
- * Constructor.
- */
- public AbstractEncryptTokenAction() {
- encryptionContextLookupStrategy = new ChildContextLookup<>(EncryptionContext.class).compose(
- new ChildContextLookup<>(RelyingPartyContext.class));
- }
-
- /**
- * Set the strategy used to look up the {@link EncryptionContext} to set the flags for.
- *
- * @param strategy lookup strategy
- */
- public void setEncryptionContextLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,EncryptionContext> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- encryptionContextLookupStrategy =
- Constraint.isNotNull(strategy, "EncryptionContext lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- if (!super.doPreExecute(profileRequestContext)) {
- return false;
- }
-
- final EncryptionContext encryptCtx = encryptionContextLookupStrategy.apply(profileRequestContext);
- if (encryptCtx == null) {
- log.error("{} No EncryptionContext returned by lookup strategy", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
- return false;
- }
- params = encryptCtx.getAssertionEncryptionParameters();
- if (params == null) {
- log.debug("{} No Encryption parameters, nothing to do", getLogPrefix());
- return false;
- }
-
- return true;
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
-
- final Payload payload = getPayload(profileRequestContext);
- if (payload == null) {
- log.debug("{} No plain text source provided to encrypt", getLogPrefix());
- return;
- }
-
- final JWEAlgorithm encAlg = JWEAlgorithm.parse(params.getKeyTransportEncryptionAlgorithm());
- final Credential credential = params.getKeyTransportEncryptionCredential();
- final EncryptionMethod encEnc = EncryptionMethod.parse(params.getDataEncryptionAlgorithm());
- final String kid = CredentialConversionUtil.resolveKid(credential);
-
- log.debug("{} Encrypting with kid {} and params alg: {} enc: {}", getLogPrefix(), kid, encAlg.getName(),
- encEnc.getName());
-
- final JWEObject jweObject =
- new JWEObject(new JWEHeader.Builder(encAlg, encEnc).contentType("JWT").keyID(kid).build(), payload);
- try {
- if (JWEAlgorithm.Family.RSA.contains(encAlg)) {
- jweObject.encrypt(new RSAEncrypter((RSAPublicKey) credential.getPublicKey()));
- } else if (JWEAlgorithm.Family.ECDH_ES.contains(encAlg)) {
- jweObject.encrypt(new ECDHEncrypter((ECPublicKey) credential.getPublicKey()));
- } else if (JWEAlgorithm.Family.SYMMETRIC.contains(encAlg)) {
- jweObject.encrypt(new AESEncrypter(credential.getSecretKey()));
- } else {
- log.error("{} Unsupported algorithm {}", getLogPrefix(), encAlg.getName());
- ActionSupport.buildEvent(profileRequestContext, EventIds.UNABLE_TO_ENCRYPT);
- }
- setProcessedToken(profileRequestContext, EncryptedJWT.parse(jweObject.serialize()));
- } catch (final JOSEException | ParseException e) {
- log.error("{} Encryption failed {}", getLogPrefix(), e);
- ActionSupport.buildEvent(profileRequestContext, EventIds.UNABLE_TO_ENCRYPT);
- }
- }
-
- /**
- * Get the payload to encrypt.
- *
- * @param profileRequestContext profile request context
- *
- * @return payload to encrypt
- */
- @Nonnull protected abstract Payload getPayload(@Nonnull final ProfileRequestContext profileRequestContext);
-
- /**
- * Store the resulting token.
- *
- * @param profileRequestContext profile request context
- * @param token encrypted token
- */
- protected abstract void setProcessedToken(@Nonnull final ProfileRequestContext profileRequestContext,
- @Nonnull final EncryptedJWT token);
-
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/SignAccessToken.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/SignAccessToken.java
deleted file mode 100644
index 3f2c0a23..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/SignAccessToken.java
+++ /dev/null
@@ -1,129 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl;
-
-import java.text.ParseException;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
-import org.opensaml.profile.action.ActionSupport;
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.profile.context.navigate.OutboundMessageContextLookup;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import com.nimbusds.jwt.JWTClaimsSet;
-import com.nimbusds.jwt.SignedJWT;
-
-import net.shibboleth.idp.plugin.oidc.op.messaging.context.AccessTokenContext;
-import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
-import net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractSignJWTAction;
-import net.shibboleth.utilities.java.support.component.ComponentSupport;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-
-/**
- * Action that signs {@link AccessTokenContext#getJWT()} and overwrites it with the signed version.
- *
- * <p>The action exits gracefully if no signing parameters exist or the JWT does not exist.</p>
- *
- * @event {@link EventIds#PROCEED_EVENT_ID}
- * @event {@link EventIds#MESSAGE_PROC_ERROR}
- * @event {@link EventIds#INVALID_MSG_CTX}
- */
-public class SignAccessToken extends AbstractSignJWTAction {
-
- /** Class logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(SignAccessToken.class);
-
- /** Strategy used to locate the subcontext with the token. */
- @Nonnull private Function<ProfileRequestContext,AccessTokenContext> accessTokenContextLookupStrategy;
-
- /** Token context. */
- @Nullable private AccessTokenContext tokenCtx;
-
- /** Source of claims set to sign. */
- @Nullable private JWTClaimsSet claimsSet;
-
- /** Constructor. */
- public SignAccessToken() {
- // PRC -> inbound message context -> OIDC response context -> ATC
- accessTokenContextLookupStrategy = new ChildContextLookup<>(AccessTokenContext.class, true).compose(
- new ChildContextLookup<>(OIDCAuthenticationResponseContext.class).compose(
- new OutboundMessageContextLookup()));
- }
-
- /**
- * Set the strategy used to create the {@link AccessTokenContext} to use.
- *
- * @param strategy creation strategy
- */
- public void setAccessTokenContextCreationStrategy(
- @Nonnull final Function<ProfileRequestContext,AccessTokenContext> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- accessTokenContextLookupStrategy =
- Constraint.isNotNull(strategy, "AccessTokenContext creation strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
-
- if (!super.doPreExecute(profileRequestContext)) {
- return false;
- }
-
- tokenCtx = accessTokenContextLookupStrategy.apply(profileRequestContext);
- if (tokenCtx == null) {
- log.error("{} AccessTokenContext is missing", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
- return false;
- }
-
- if (tokenCtx.getJWT() == null) {
- log.debug("{} JWT is absent, nothing to do", getLogPrefix());
- return false;
- }
-
- try {
- claimsSet = tokenCtx.getJWT().getJWTClaimsSet();
- } catch (final ParseException e) {
- log.error("{} Access token JWT parsing failed: {}", getLogPrefix(), e.getMessage());
- ActionSupport.buildEvent(profileRequestContext, EventIds.MESSAGE_PROC_ERROR);
- return false;
- }
-
- return true;
- }
-
- /** {@inheritDoc} */
- @Override
- @Nonnull protected JWTClaimsSet getClaimsSetToSign() {
- return claimsSet;
- }
-
- /** {@inheritDoc} */
- @Override
- protected void setSignedJWT(@Nonnull final SignedJWT jwt) {
- tokenCtx.setJWT(jwt);
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateRequestObject.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateRequestObject.java
index 22cd7d71..02ad8315 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateRequestObject.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateRequestObject.java
@@ -26,6 +26,7 @@ import javax.annotation.Nullable;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
import org.opensaml.xmlsec.context.SecurityParametersContext;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -41,7 +42,7 @@ import com.nimbusds.oauth2.sdk.id.ClientID;
import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
import net.shibboleth.oidc.jwt.claims.JWTValidationException;
import net.shibboleth.oidc.profile.core.OidcEventIds;
-import net.shibboleth.oidc.security.impl.JWTSignatureValidationUtil;
+import net.shibboleth.oidc.security.context.JWTSecurityParametersContext;
import net.shibboleth.oidc.security.impl.OIDCSignatureValidationParameters;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
@@ -62,7 +63,7 @@ public class ValidateRequestObject extends AbstractOAuthAuthorizationResponseAct
/**
* Strategy used to locate the {@link SecurityParametersContext} to use for signing.
*/
- @Nonnull private Function<ProfileRequestContext, SecurityParametersContext> securityParametersLookupStrategy;
+ @Nonnull private Function<ProfileRequestContext, JWTSecurityParametersContext> securityParametersLookupStrategy;
/** Request Object. */
@Nullable private JWT requestObject;
@@ -75,16 +76,17 @@ public class ValidateRequestObject extends AbstractOAuthAuthorizationResponseAct
/** Constructor. */
public ValidateRequestObject() {
- securityParametersLookupStrategy = new ChildContextLookup<>(SecurityParametersContext.class);
+ securityParametersLookupStrategy = new ChildContextLookup<>(JWTSecurityParametersContext.class).compose(
+ new InboundMessageContextLookup());
}
/**
- * Set the strategy used to locate the {@link SecurityParametersContext} to use.
+ * Set the strategy used to locate the {@link JWTSecurityParametersContext} to use.
*
* @param strategy lookup strategy
*/
public void setSecurityParametersLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, SecurityParametersContext> strategy) {
+ @Nonnull final Function<ProfileRequestContext, JWTSecurityParametersContext> strategy) {
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
securityParametersLookupStrategy =
@@ -162,19 +164,7 @@ public class ValidateRequestObject extends AbstractOAuthAuthorizationResponseAct
return;
}
}
-
- // Signature of signed request object must be verified
- if (!(requestObject instanceof PlainJWT)) {
- // Verify req object is signed with correct algorithm
- final SecurityParametersContext secParamCtx = securityParametersLookupStrategy.apply(profileRequestContext);
- final String errorEventId = JWTSignatureValidationUtil.validateSignature(secParamCtx,
- (SignedJWT) requestObject, OidcEventIds.INVALID_REQUEST_OBJECT);
- if (errorEventId != null) {
- ActionSupport.buildEvent(profileRequestContext, errorEventId);
- return;
- }
- }
final JWTClaimsSet claimsSet;
// Validate still client_id and response_type values
try {
@@ -202,6 +192,7 @@ public class ValidateRequestObject extends AbstractOAuthAuthorizationResponseAct
try {
if (requestObject instanceof SignedJWT) {
+ // Signature of signed request object is handled earlier in the flow
signedClaimsValidator.validate(claimsSet, profileRequestContext);
} else {
plainClaimsValidator.validate(claimsSet, profileRequestContext);
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCSigningResponseAction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCSigningResponseAction.java
index 14cba47c..7a030cfe 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCSigningResponseAction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCSigningResponseAction.java
@@ -21,13 +21,16 @@ import java.util.function.Function;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+
import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.xmlsec.SignatureSigningParameters;
+import org.opensaml.profile.context.navigate.OutboundMessageContextLookup;
import org.opensaml.xmlsec.context.SecurityParametersContext;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import net.shibboleth.oidc.security.JWTSignatureSigningParameters;
+import net.shibboleth.oidc.security.context.JWTSecurityParametersContext;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
@@ -43,14 +46,15 @@ public abstract class AbstractOIDCSigningResponseAction extends AbstractOIDCResp
/**
* Strategy used to locate the {@link SecurityParametersContext} to use for signing.
*/
- @Nonnull private Function<ProfileRequestContext, SecurityParametersContext> securityParametersLookupStrategy;
+ @Nonnull private Function<ProfileRequestContext, JWTSecurityParametersContext> securityParametersLookupStrategy;
/** The signature signing parameters. */
- @Nullable private SignatureSigningParameters signatureSigningParameters;
+ @Nullable private JWTSignatureSigningParameters signatureSigningParameters;
/** Constructor. */
public AbstractOIDCSigningResponseAction() {
- securityParametersLookupStrategy = new ChildContextLookup<>(SecurityParametersContext.class);
+ securityParametersLookupStrategy = new ChildContextLookup<>(JWTSecurityParametersContext.class)
+ .compose(new OutboundMessageContextLookup());
}
/**
@@ -59,7 +63,7 @@ public abstract class AbstractOIDCSigningResponseAction extends AbstractOIDCResp
* @param strategy lookup strategy
*/
public void setSecurityParametersLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, SecurityParametersContext> strategy) {
+ @Nonnull final Function<ProfileRequestContext, JWTSecurityParametersContext> strategy) {
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
securityParametersLookupStrategy =
@@ -71,7 +75,7 @@ public abstract class AbstractOIDCSigningResponseAction extends AbstractOIDCResp
*
* @return the signing parameters
*/
- @Nullable public SignatureSigningParameters getSignatureSigningParameters() {
+ @Nullable public JWTSignatureSigningParameters getSignatureSigningParameters() {
return signatureSigningParameters;
}
@@ -83,7 +87,7 @@ public abstract class AbstractOIDCSigningResponseAction extends AbstractOIDCResp
return false;
}
- final SecurityParametersContext secParamCtx = securityParametersLookupStrategy.apply(profileRequestContext);
+ final JWTSecurityParametersContext secParamCtx = securityParametersLookupStrategy.apply(profileRequestContext);
if (secParamCtx == null) {
log.debug("{} no security parameters context is available", getLogPrefix());
return false;
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractSignJWTAction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractSignJWTAction.java
deleted file mode 100644
index 4bb16d9e..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractSignJWTAction.java
+++ /dev/null
@@ -1,169 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.profile.impl;
-
-import java.security.interfaces.ECPrivateKey;
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.action.ActionSupport;
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.security.credential.Credential;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import com.nimbusds.jose.Algorithm;
-import com.nimbusds.jose.JOSEException;
-import com.nimbusds.jose.JOSEObjectType;
-import com.nimbusds.jose.JWSAlgorithm;
-import com.nimbusds.jose.JWSHeader;
-import com.nimbusds.jose.JWSSigner;
-import com.nimbusds.jose.crypto.ECDSASigner;
-import com.nimbusds.jose.crypto.MACSigner;
-import com.nimbusds.jose.crypto.RSASSASigner;
-import com.nimbusds.jwt.JWTClaimsSet;
-import com.nimbusds.jwt.SignedJWT;
-
-import net.shibboleth.oidc.security.credential.JWKCredential;
-import net.shibboleth.oidc.security.impl.CredentialConversionUtil;
-import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
-import net.shibboleth.utilities.java.support.component.ComponentSupport;
-import net.shibboleth.utilities.java.support.primitive.StringSupport;
-
-/**
- * Abstract action for signing JWT. The extending class is expected to set claims set by implementing
- * {@link #getClaimsSetToSign}. The signed jwt is received by extending class by implementing method
- * {@link #setSignedJWT}.
- */
-public abstract class AbstractSignJWTAction extends AbstractOIDCSigningResponseAction {
-
- /** Class logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(AbstractSignJWTAction.class);
-
- /** "typ" header to insert while signing. */
- @Nullable @NotEmpty private String typeHeader;
-
- /** resolved credential. */
- @Nullable private Credential credential;
-
- /**
- * Sets the value to be inserted as a "typ" header for the JWS.
- *
- * @param type header value
- *
- * @since 3.1.0
- */
- public void setTypeHeader(@Nullable @NotEmpty final String type) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- typeHeader = StringSupport.trimOrNull(type);
- }
-
- /** {@inheritDoc} */
- @Override
- protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
-
- if (!super.doPreExecute(profileRequestContext)) {
- return false;
- }
-
- credential = getSignatureSigningParameters().getSigningCredential();
- return true;
- }
-
- /**
- * Returns correct implementation of signer based on algorithm type.
- *
- * @param jwsAlgorithm JWS algorithm
- * @return signer for algorithm and private key
- * @throws JOSEException if algorithm cannot be supported
- */
- private JWSSigner getSigner(final Algorithm jwsAlgorithm) throws JOSEException {
- if (JWSAlgorithm.Family.EC.contains(jwsAlgorithm)) {
- return new ECDSASigner((ECPrivateKey) credential.getPrivateKey());
- }
- if (JWSAlgorithm.Family.RSA.contains(jwsAlgorithm)) {
- return new RSASSASigner(credential.getPrivateKey());
- }
- if (JWSAlgorithm.Family.HMAC_SHA.contains(jwsAlgorithm)) {
- return new MACSigner(credential.getSecretKey());
- }
- throw new JOSEException("Unsupported algorithm " + jwsAlgorithm.getName());
- }
-
- /**
- * Resolves JWS algorithm from signature signing parameters.
- *
- * @return JWS algorithm
- */
- protected JWSAlgorithm resolveAlgorithm() {
-
- final JWSAlgorithm algorithm = new JWSAlgorithm(getSignatureSigningParameters().getSignatureAlgorithm());
- if (credential instanceof JWKCredential) {
- if (!algorithm.equals(((JWKCredential) credential).getAlgorithm())) {
- log.debug("{} Signature signing algorithm {} differs from JWK algorithm {}", getLogPrefix(),
- algorithm.getName(), ((JWKCredential) credential).getAlgorithm());
- }
- }
- log.debug("{} Algorithm resolved {}", getLogPrefix(), algorithm.getName());
- return algorithm;
- }
-
- /**
- * Called with signed JWT as parameter.
- *
- * @param jwt signed JWT.
- */
- protected abstract void setSignedJWT(@Nullable SignedJWT jwt);
-
- /**
- * Called to get claim set to sign.
- *
- * @return claim set to sign
- */
- protected abstract @Nonnull JWTClaimsSet getClaimsSetToSign();
-
- /** {@inheritDoc} */
- @Override
- protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
-
- SignedJWT jwt = null;
- final JWTClaimsSet jwtClaimSet = getClaimsSetToSign();
- if (jwtClaimSet == null) {
- log.debug("Claim set is null, nothing to do");
- return;
- }
- try {
- final Algorithm jwsAlgorithm = resolveAlgorithm();
- final JWSSigner signer = getSigner(jwsAlgorithm);
- final JWSHeader.Builder headerBuilder = new JWSHeader.Builder(new JWSAlgorithm(jwsAlgorithm.getName()))
- .keyID(CredentialConversionUtil.resolveKid(credential));
- if (typeHeader != null) {
- headerBuilder.type(new JOSEObjectType(typeHeader));
- }
- jwt = new SignedJWT(headerBuilder.build(), jwtClaimSet);
- jwt.sign(signer);
- } catch (final JOSEException e) {
- log.error("{} Error signing claim set: {}", getLogPrefix(), e.getMessage());
- ActionSupport.buildEvent(profileRequestContext, EventIds.UNABLE_TO_SIGN);
- return;
- }
- setSignedJWT(jwt);
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddRequestObjectSecurityConfigurationToClientMetadata.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddRequestObjectSecurityConfigurationToClientMetadata.java
index f29c2063..e6fa4df7 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddRequestObjectSecurityConfigurationToClientMetadata.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddRequestObjectSecurityConfigurationToClientMetadata.java
@@ -34,9 +34,9 @@ import com.nimbusds.jose.JWEAlgorithm;
import com.nimbusds.jose.JWSAlgorithm;
import net.shibboleth.oidc.jwa.support.SignatureConstants;
-import net.shibboleth.oidc.profile.config.navigate.DataEncryptionAlgorithmsLookupFunction;
-import net.shibboleth.oidc.profile.config.navigate.KeyTransportEncryptionAlgorithmsLookupFunction;
-import net.shibboleth.oidc.profile.config.navigate.SignatureAlgorithmsLookupFunction;
+import net.shibboleth.oidc.profile.config.navigate.JWEDataEncryptionAlgorithmsLookupFunction;
+import net.shibboleth.oidc.profile.config.navigate.JWEKeyTransportEncryptionAlgorithmsLookupFunction;
+import net.shibboleth.oidc.profile.config.navigate.JWSSignatureAlgorithmsLookupFunction;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
@@ -79,9 +79,9 @@ public class AddRequestObjectSecurityConfigurationToClientMetadata extends Abstr
/** Constructor. */
public AddRequestObjectSecurityConfigurationToClientMetadata() {
- signatureAlgorithmsLookupStrategy = new SignatureAlgorithmsLookupFunction();
- dataEncryptionAlgorithmsLookupStrategy = new DataEncryptionAlgorithmsLookupFunction();
- keyTransportEncryptionAlgorithmsLookupStrategy = new KeyTransportEncryptionAlgorithmsLookupFunction();
+ signatureAlgorithmsLookupStrategy = new JWSSignatureAlgorithmsLookupFunction();
+ dataEncryptionAlgorithmsLookupStrategy = new JWEDataEncryptionAlgorithmsLookupFunction();
+ keyTransportEncryptionAlgorithmsLookupStrategy = new JWEKeyTransportEncryptionAlgorithmsLookupFunction();
}
/**
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddSecurityConfigurationToClientMetadata.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddSecurityConfigurationToClientMetadata.java
index 48207115..332cde1a 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddSecurityConfigurationToClientMetadata.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddSecurityConfigurationToClientMetadata.java
@@ -36,9 +36,9 @@ import com.nimbusds.jose.JWSAlgorithm;
import com.nimbusds.oauth2.sdk.ResponseType;
import net.shibboleth.oidc.jwa.support.SignatureConstants;
-import net.shibboleth.oidc.profile.config.navigate.DataEncryptionAlgorithmsLookupFunction;
-import net.shibboleth.oidc.profile.config.navigate.KeyTransportEncryptionAlgorithmsLookupFunction;
-import net.shibboleth.oidc.profile.config.navigate.SignatureAlgorithmsLookupFunction;
+import net.shibboleth.oidc.profile.config.navigate.JWEDataEncryptionAlgorithmsLookupFunction;
+import net.shibboleth.oidc.profile.config.navigate.JWEKeyTransportEncryptionAlgorithmsLookupFunction;
+import net.shibboleth.oidc.profile.config.navigate.JWSSignatureAlgorithmsLookupFunction;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
@@ -77,9 +77,9 @@ public class AddSecurityConfigurationToClientMetadata extends AbstractOIDCClient
/** Constructor. */
public AddSecurityConfigurationToClientMetadata() {
- signatureAlgorithmsLookupStrategy = new SignatureAlgorithmsLookupFunction();
- dataEncryptionAlgorithmsLookupStrategy = new DataEncryptionAlgorithmsLookupFunction();
- keyTransportEncryptionAlgorithmsLookupStrategy = new KeyTransportEncryptionAlgorithmsLookupFunction();
+ signatureAlgorithmsLookupStrategy = new JWSSignatureAlgorithmsLookupFunction();
+ dataEncryptionAlgorithmsLookupStrategy = new JWEDataEncryptionAlgorithmsLookupFunction();
+ keyTransportEncryptionAlgorithmsLookupStrategy = new JWEKeyTransportEncryptionAlgorithmsLookupFunction();
}
/**
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/EncryptProcessedToken.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/EncryptProcessedToken.java
deleted file mode 100644
index 5a82b9b9..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/EncryptProcessedToken.java
+++ /dev/null
@@ -1,62 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.profile.impl;
-
-import javax.annotation.Nonnull;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import com.nimbusds.jose.Payload;
-import com.nimbusds.jwt.EncryptedJWT;
-import com.nimbusds.jwt.SignedJWT;
-
-import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
-import net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.AbstractEncryptTokenAction;
-
-/**
- * Action that serves both id token and user info response encryption.
- *
- * <p>Action assumes the content to be encrypted is located primarily
- * by {@link OIDCAuthenticationResponseContext#getProcessedToken()} returning either signed id token or signed user info
- * response. If such information is not available action assumes the data to be encrypted is
- * {@link OIDCAuthenticationResponseContext#getUserInfo()} containing bare user info response. If neither of the sources
- * for encryption exists the actions fails.</p>
- */
-public class EncryptProcessedToken extends AbstractEncryptTokenAction {
-
- /** {@inheritDoc} */
- @Override
- protected Payload getPayload(@Nonnull final ProfileRequestContext profileRequestContext) {
-
- if (getOidcResponseContext().getProcessedToken() != null) {
- return new Payload((SignedJWT) getOidcResponseContext().getProcessedToken());
- } else if (getOidcResponseContext().getUserInfo() != null) {
- return new Payload(getOidcResponseContext().getUserInfo().toJSONObject());
- } else {
- return null;
- }
- }
-
- /** {@inheritDoc} */
- @Override
- protected void setProcessedToken(@Nonnull final ProfileRequestContext profileRequestContext,
- @Nonnull final EncryptedJWT token) {
- getOidcResponseContext().setProcessedToken(token);
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/PopulateOIDCEncryptionParameters.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/PopulateOIDCEncryptionParameters.java
deleted file mode 100644
index 58963056..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/PopulateOIDCEncryptionParameters.java
+++ /dev/null
@@ -1,301 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.profile.impl;
-
-import java.util.Collections;
-import java.util.List;
-import java.util.function.Function;
-import java.util.function.Predicate;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.action.ActionSupport;
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.saml.saml2.profile.context.EncryptionContext;
-import org.opensaml.xmlsec.EncryptionConfiguration;
-import org.opensaml.xmlsec.EncryptionParameters;
-import org.opensaml.xmlsec.EncryptionParametersResolver;
-import org.opensaml.xmlsec.SecurityConfigurationSupport;
-import org.opensaml.xmlsec.criterion.EncryptionConfigurationCriterion;
-import org.opensaml.xmlsec.criterion.EncryptionOptionalCriterion;
-
-import net.shibboleth.idp.plugin.oidc.op.criterion.ClientInformationCriterion;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultOIDCMetadataContextLookupFunction;
-import net.shibboleth.idp.profile.AbstractProfileAction;
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
-import net.shibboleth.oidc.profile.config.logic.EncryptionOptionalPredicate;
-import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-import net.shibboleth.utilities.java.support.component.ComponentSupport;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
-import net.shibboleth.utilities.java.support.resolver.ResolverException;
-
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-/**
- * Action that resolves and populates {@link EncryptionParameters} on an {@link EncryptionContext} created/accessed via
- * a lookup function, by default on a {@link RelyingPartyContext} child of the profile request context.
- *
- * The parameters are used either to encrypt id token / userinfo response or to decrypt request object. For the first
- * case the parameters are set with {@link EncryptionContext#setAssertionEncryptionParameters}, for request object
- * decryption the parameters are set with {@link EncryptionContext#setAttributeEncryptionParameters}. Yes, we are
- * stealing and bit misusing existing Shib context for our own almost similar purposes.
- *
- *
- * <p>
- * The OpenSAML default, per-RelyingParty, and default per-profile {@link EncryptionConfiguration} objects are input to
- * the resolution process, along with the relying party's oidc client registration data, which in most cases will be the
- * source of the eventual encryption key.
- * </p>
- *
- */
-public class PopulateOIDCEncryptionParameters extends AbstractProfileAction {
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(PopulateOIDCEncryptionParameters.class);
-
- /** Whether we resolve encryption or decryption parameters. */
- private boolean forDecryption;
-
- /** Predicate to determine how to proceed if no encryption parameters are resolved. */
- @Nonnull private Predicate<ProfileRequestContext> encryptionOptionalPredicate;
-
- /** Strategy used to look up the {@link EncryptionContext} to store parameters in. */
- @Nonnull private Function<ProfileRequestContext,EncryptionContext> encryptionContextLookupStrategy;
-
- /** Strategy used to look up a per-request {@link EncryptionConfiguration} list. */
- @NonnullAfterInit private Function<ProfileRequestContext,List<EncryptionConfiguration>> configurationLookupStrategy;
-
- /** Resolver for parameters to store into context. */
- @NonnullAfterInit private EncryptionParametersResolver encParamsresolver;
-
- /** Active configurations to feed into resolver. */
- @Nullable @NonnullElements private List<EncryptionConfiguration> encryptionConfigurations;
-
- /** Strategy used to look up a OIDC metadata context. */
- @Nullable private Function<ProfileRequestContext,OIDCMetadataContext> oidcMetadataContextLookupStrategy;
-
- /** Whether encryption is optional. */
- private boolean encryptionOptional;
-
- /** Context to populate. */
- private EncryptionContext encryptionContext;
-
- /** Constructor. */
- public PopulateOIDCEncryptionParameters() {
- // Create context by default.
- oidcMetadataContextLookupStrategy = new DefaultOIDCMetadataContextLookupFunction();
- encryptionContextLookupStrategy = new ChildContextLookup<>(EncryptionContext.class, true).compose(
- new ChildContextLookup<>(RelyingPartyContext.class));
- encryptionOptionalPredicate = new EncryptionOptionalPredicate();
- }
-
- /**
- * Whether we resolve encryption or decryption parameters.
- *
- * @param flag true if we should resolve decryption parameters.
- */
- public void setForDecryption(final boolean flag) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- forDecryption = flag;
- }
-
- /**
- * Sets the condition to apply to determine how to proceed if encryption parameter resolution fails.
- *
- * @param condition condition to set
- *
- * @since 3.1.0
- */
- public void setEncryptionOptionalPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- encryptionOptionalPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
- }
-
- /**
- * Set the strategy used to look up the {@link EncryptionContext} to set the flags for.
- *
- * @param strategy lookup strategy
- */
- public void setEncryptionContextLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, EncryptionContext> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- encryptionContextLookupStrategy =
- Constraint.isNotNull(strategy, "EncryptionContext lookup strategy cannot be null");
- }
-
- /**
- * Set the strategy used to look up the {@link OIDCMetadataContext} to locate client registered encryption
- * parameters.
- *
- * @param strategy lookup strategy
- */
- public void setOidcMetadataContextLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, OIDCMetadataContext> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- oidcMetadataContextLookupStrategy =
- Constraint.isNotNull(strategy, " OIDCMetadataContext lookup strategy cannot be null");
- }
-
- /**
- * Set the strategy used to look up a per-request {@link EncryptionConfiguration} list.
- *
- * @param strategy lookup strategy
- */
- public void setConfigurationLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, List<EncryptionConfiguration>> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- configurationLookupStrategy =
- Constraint.isNotNull(strategy, "EncryptionConfiguration lookup strategy cannot be null");
- }
-
- /**
- * Set the encParamsresolver to use for the parameters to store into the context.
- *
- * @param newResolver encParamsresolver to use
- */
- public void setEncryptionParametersResolver(@Nonnull final EncryptionParametersResolver newResolver) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- encParamsresolver = Constraint.isNotNull(newResolver, "EncryptionParametersResolver cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
-
- if (encParamsresolver == null) {
- throw new ComponentInitializationException("EncryptionParametersResolver cannot be null");
- } else if (configurationLookupStrategy == null) {
- configurationLookupStrategy = new Function<ProfileRequestContext, List<EncryptionConfiguration>>() {
- public List<EncryptionConfiguration> apply(final ProfileRequestContext input) {
- return Collections.singletonList(SecurityConfigurationSupport.getGlobalEncryptionConfiguration());
- }
- };
- }
- }
-
- /** {@inheritDoc} */
- @Override
- protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- if (!super.doPreExecute(profileRequestContext)) {
- return false;
- }
-
- encryptionContext = encryptionContextLookupStrategy.apply(profileRequestContext);
- if (encryptionContext == null) {
- log.debug("{} No EncryptionContext returned by lookup strategy", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
- return false;
- }
-
- if (!forDecryption) {
- encryptionOptional = encryptionOptionalPredicate.test(profileRequestContext);
- }
-
- return true;
- }
-
-// Checkstyle: CyclomaticComplexity OFF
- /** {@inheritDoc} */
- @Override
- protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
-
- log.debug("{} Resolving EncryptionParameters for {}", getLogPrefix(),
- forDecryption ? "request object decryption" : "response encryption");
-
- try {
- encryptionConfigurations = configurationLookupStrategy.apply(profileRequestContext);
- if (encryptionConfigurations == null || encryptionConfigurations.isEmpty()) {
- throw new ResolverException("No EncryptionConfigurations returned by lookup strategy");
- }
- final CriteriaSet criteria = buildCriteriaSet(profileRequestContext);
- final EncryptionParameters params = encParamsresolver.resolveSingle(criteria);
-
- if (params != null) {
- log.debug("{} Resolved EncryptionParameters for {}", getLogPrefix(),
- forDecryption ? "request object decryption" : "response encryption");
- if (forDecryption) {
- // Decryption parameters for request object decryption
- encryptionContext.setAttributeEncryptionParameters(params);
- } else {
- // Indicates that id token or userinfo response should be encrypted
- encryptionContext.setAssertionEncryptionParameters(params);
- }
- } else {
- if (encryptionOptional) {
- log.debug("{} Resolver returned no EncryptionParameters", getLogPrefix());
- log.debug("{} Encryption is optional, ignoring inability to encrypt", getLogPrefix());
- } else {
- log.warn("{} Resolver returned no EncryptionParameters", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_SEC_CFG);
- }
- }
- } catch (final ResolverException e) {
- log.error("{} Error resolving EncryptionParameters", getLogPrefix(), e);
- if (encryptionOptional) {
- log.debug("{} Encryption is optional, ignoring inability to encrypt", getLogPrefix());
- } else {
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_SEC_CFG);
- }
- }
- }
-// Checkstyle: CyclomaticComplexity ON
-
- /**
- * Build the criteria used as input to the {@link EncryptionParametersResolver}.
- *
- * @param profileRequestContext current profile request context
- *
- * @return the criteria set to use
- */
- @Nonnull
- private CriteriaSet buildCriteriaSet(@Nonnull final ProfileRequestContext profileRequestContext) {
-
- final CriteriaSet criteria = new CriteriaSet(new EncryptionConfigurationCriterion(encryptionConfigurations));
-
- if (!forDecryption) {
- criteria.add(new EncryptionOptionalCriterion(encryptionOptional));
- }
-
- final OIDCMetadataContext oidcMetadataCtx = oidcMetadataContextLookupStrategy.apply(profileRequestContext);
- if (oidcMetadataCtx != null && oidcMetadataCtx.getClientInformation() != null) {
- log.debug(
- "{} Adding OIDC client information to resolution criteria for encryption algorithms",
- getLogPrefix());
- criteria.add(new ClientInformationCriterion(oidcMetadataCtx.getClientInformation()));
- } else {
- log.debug("{} No OIDC client information available", getLogPrefix());
- }
- return criteria;
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/PopulateOIDCSignatureSigningParameters.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/PopulateOIDCSignatureSigningParameters.java
deleted file mode 100644
index 8b1adb2a..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/PopulateOIDCSignatureSigningParameters.java
+++ /dev/null
@@ -1,239 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.profile.impl;
-
-import java.util.Collections;
-import java.util.List;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.messaging.context.MessageContext;
-import org.opensaml.messaging.context.navigate.ContextDataLookupFunction;
-import org.opensaml.profile.action.AbstractHandlerDelegatingProfileAction;
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.saml.common.messaging.context.SAMLMetadataContext;
-import org.opensaml.saml.common.profile.impl.PopulateSignatureSigningParameters;
-import org.opensaml.xmlsec.SecurityConfigurationSupport;
-import org.opensaml.xmlsec.SignatureSigningConfiguration;
-import org.opensaml.xmlsec.SignatureSigningParameters;
-import org.opensaml.xmlsec.SignatureSigningParametersResolver;
-import org.opensaml.xmlsec.context.SecurityParametersContext;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
-import net.shibboleth.utilities.java.support.annotation.ParameterName;
-import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-import net.shibboleth.utilities.java.support.component.ComponentSupport;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-
-/**
- * Action that resolves and populates {@link SignatureSigningParameters} on a {@link SecurityParametersContext}
- * created/accessed via a lookup function, by default on the outbound message context.
- *
- * @event {@link EventIds#PROCEED_EVENT_ID}
- * @event {@link EventIds#INVALID_MSG_CTX}
- * @event {@link EventIds#INVALID_SEC_CFG}
- *
- * Based purely on {@link PopulateSignatureSigningParameters}.
- */
-public class PopulateOIDCSignatureSigningParameters
- extends AbstractHandlerDelegatingProfileAction<PopulateOIDCSignatureSigningParametersHandler> {
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(PopulateOIDCSignatureSigningParameters.class);
-
- /** Strategy used to look up the {@link SecurityParametersContext} to set the parameters for. */
- @Nullable
- private Function<ProfileRequestContext, SecurityParametersContext> securityParametersContextLookupStrategy;
-
- /** Strategy used to look up an existing {@link SecurityParametersContext} to copy. */
- @Nullable private Function<ProfileRequestContext,SecurityParametersContext> existingParametersContextLookupStrategy;
-
- /** Strategy used to look up a per-request {@link SignatureSigningConfiguration} list. */
- @NonnullAfterInit
- private Function<ProfileRequestContext,List<SignatureSigningConfiguration>> configurationLookupStrategy;
-
- /** Strategy used to look up a SAML metadata context. */
- @Nullable private Function<ProfileRequestContext, SAMLMetadataContext> metadataContextLookupStrategy;
-
- /** Strategy used to look up a OIDC metadata context. */
- @Nullable private Function<MessageContext, OIDCMetadataContext> oidcMetadataContextLookupStrategy;
-
- /** Resolver for parameters to store into context. */
- @NonnullAfterInit private SignatureSigningParametersResolver resolver;
-
- /** Whether failure to resolve parameters should be raised as an error. */
- private boolean noResultIsError;
-
- /**
- * Constructor.
- *
- * @param strategy lookup strategy for message context
- */
- public PopulateOIDCSignatureSigningParameters(@ParameterName(name = "strategy")
- @Nonnull final ContextDataLookupFunction<ProfileRequestContext,MessageContext> strategy) {
- super(PopulateOIDCSignatureSigningParametersHandler.class, strategy);
-
- setErrorEvent(EventIds.INVALID_SEC_CFG);
- }
-
- /**
- * Set the strategy used to look up the {@link SecurityParametersContext} to set the parameters for.
- *
- * @param strategy lookup strategy
- */
- public void setSecurityParametersContextLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, SecurityParametersContext> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- securityParametersContextLookupStrategy =
- Constraint.isNotNull(strategy, "SecurityParametersContext lookup strategy cannot be null");
- }
-
- /**
- * Set the strategy used to look up an existing {@link SecurityParametersContext} to copy instead of actually
- * resolving the parameters to set.
- *
- * @param strategy lookup strategy
- */
- public void setExistingParametersContextLookupStrategy(
- @Nullable final Function<ProfileRequestContext, SecurityParametersContext> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- existingParametersContextLookupStrategy = strategy;
- }
-
- /**
- * Set lookup strategy for {@link SAMLMetadataContext} for input to resolution.
- *
- * @param strategy lookup strategy
- */
- public void setMetadataContextLookupStrategy(
- @Nullable final Function<ProfileRequestContext, SAMLMetadataContext> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- metadataContextLookupStrategy = strategy;
- }
-
- /**
- * Set lookup strategy for {@link OIDCMetadataContext} for input to resolution.
- *
- * @param strategy lookup strategy
- *
- * @since 3.1.0
- */
- public void setOidcMetadataContextLookupStrategy(
- @Nullable final Function<MessageContext,OIDCMetadataContext> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- oidcMetadataContextLookupStrategy = strategy;
- }
-
- /**
- * Set the strategy used to look up a per-request {@link SignatureSigningConfiguration} list.
- *
- * @param strategy lookup strategy
- */
- public void setConfigurationLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, List<SignatureSigningConfiguration>> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- configurationLookupStrategy =
- Constraint.isNotNull(strategy, "SignatureSigningConfiguration lookup strategy cannot be null");
- }
-
- /**
- * Set the resolver to use for the parameters to store into the context.
- *
- * @param newResolver resolver to use
- */
- public void setSignatureSigningParametersResolver(@Nonnull final SignatureSigningParametersResolver newResolver) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- resolver = Constraint.isNotNull(newResolver, "SignatureSigningParametersResolver cannot be null");
- }
-
- /**
- * Set whether a failure to resolve any parameters should be raised as an exception.
- *
- * <p>
- * Defaults to false.
- * </p>
- *
- * @param flag flag to set
- *
- * @since 3.4.0
- */
- public void setNoResultIsError(final boolean flag) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- noResultIsError = flag;
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
-
- if (resolver == null) {
- throw new ComponentInitializationException("SignatureSigningParametersResolver cannot be null");
- } else if (configurationLookupStrategy == null) {
- configurationLookupStrategy = new Function<ProfileRequestContext, List<SignatureSigningConfiguration>>() {
- public List<SignatureSigningConfiguration> apply(final ProfileRequestContext input) {
- return Collections
- .singletonList(SecurityConfigurationSupport.getGlobalSignatureSigningConfiguration());
- }
- };
- }
-
- final PopulateOIDCSignatureSigningParametersHandler delegate = getDelegate();
- delegate.setNoResultIsError(noResultIsError);
- delegate.setSignatureSigningParametersResolver(resolver);
- delegate.setConfigurationLookupStrategy(adapt(configurationLookupStrategy));
- if (securityParametersContextLookupStrategy != null) {
- delegate.setSecurityParametersContextLookupStrategy(adapt(securityParametersContextLookupStrategy));
- }
- delegate.setExistingParametersContextLookupStrategy(adapt(existingParametersContextLookupStrategy));
- if (metadataContextLookupStrategy != null) {
- delegate.setMetadataContextLookupStrategy(adapt(metadataContextLookupStrategy));
- }
- if (oidcMetadataContextLookupStrategy != null) {
- delegate.setOidcMetadataContextLookupStrategy(oidcMetadataContextLookupStrategy);
- }
- delegate.initialize();
- }
-
- /** {@inheritDoc} */
- @Override
- protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
-
- if (super.doPreExecute(profileRequestContext)) {
- log.debug("{} Signing enabled", getLogPrefix());
- return true;
- } else {
- log.debug("{} Signing not enabled", getLogPrefix());
- return false;
- }
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/PopulateOIDCSignatureSigningParametersHandler.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/PopulateOIDCSignatureSigningParametersHandler.java
deleted file mode 100644
index 7cc9e201..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/PopulateOIDCSignatureSigningParametersHandler.java
+++ /dev/null
@@ -1,291 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.profile.impl;
-
-import java.util.Collections;
-import java.util.List;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.messaging.context.MessageContext;
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
-import org.opensaml.messaging.handler.AbstractMessageHandler;
-import org.opensaml.messaging.handler.MessageHandlerException;
-import org.opensaml.saml.common.binding.impl.PopulateSignatureSigningParametersHandler;
-import org.opensaml.saml.common.messaging.context.SAMLMetadataContext;
-import org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext;
-import org.opensaml.saml.criterion.RoleDescriptorCriterion;
-import org.opensaml.xmlsec.SecurityConfigurationSupport;
-import org.opensaml.xmlsec.SignatureSigningConfiguration;
-import org.opensaml.xmlsec.SignatureSigningParameters;
-import org.opensaml.xmlsec.SignatureSigningParametersResolver;
-import org.opensaml.xmlsec.context.SecurityParametersContext;
-import org.opensaml.xmlsec.criterion.SignatureSigningConfigurationCriterion;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import net.shibboleth.idp.plugin.oidc.op.criterion.ClientInformationCriterion;
-import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
-import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-import net.shibboleth.utilities.java.support.component.ComponentSupport;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
-import net.shibboleth.utilities.java.support.resolver.ResolverException;
-
-/**
- *
- * Handler that resolves and populates {@link SignatureSigningParameters} on a {@link SecurityParametersContext}
- * created/accessed via a lookup function, by default as an immediate child context of the target
- * {@link MessageContext}.
- *
- * Based on {@link PopulateSignatureSigningParametersHandler} The only addition is to add OIDCClientInformation as
- * criterion and methods related to that.
- */
-public class PopulateOIDCSignatureSigningParametersHandler extends AbstractMessageHandler {
-
- /** Class logger. */
- @Nonnull
- private final Logger log = LoggerFactory.getLogger(PopulateOIDCSignatureSigningParametersHandler.class);
-
- /** Strategy used to look up the {@link SecurityParametersContext} to set the parameters for. */
- @Nonnull private Function<MessageContext, SecurityParametersContext> securityParametersContextLookupStrategy;
-
- /** Strategy used to look up an existing {@link SecurityParametersContext} to copy. */
- @Nullable private Function<MessageContext, SecurityParametersContext> existingParametersContextLookupStrategy;
-
- /** Strategy used to look up a per-request {@link SignatureSigningConfiguration} list. */
- @NonnullAfterInit private Function<MessageContext, List<SignatureSigningConfiguration>> configurationLookupStrategy;
-
- /** Strategy used to look up a SAML metadata context. */
- @Nonnull private Function<MessageContext, SAMLMetadataContext> metadataContextLookupStrategy;
-
- /** Strategy used to look up a OIDC metadata context. */
- @Nonnull private Function<MessageContext, OIDCMetadataContext> oidcMetadataContextLookupStrategy;
-
- /** Resolver for parameters to store into context. */
- @NonnullAfterInit private SignatureSigningParametersResolver resolver;
-
- /** Whether failure to resolve parameters should be raised as an error. */
- private boolean noResultIsError;
-
- /**
- * Constructor.
- */
- public PopulateOIDCSignatureSigningParametersHandler() {
- // Create context by default.
- securityParametersContextLookupStrategy = new ChildContextLookup<>(SecurityParametersContext.class, true);
-
- // Locate directly under input context.
- oidcMetadataContextLookupStrategy = new ChildContextLookup<>(OIDCMetadataContext.class);
-
- // Default: msg context -> SAMLPeerEntityContext -> SAMLMetadataContext
- metadataContextLookupStrategy = new ChildContextLookup<>(SAMLMetadataContext.class).compose(
- new ChildContextLookup<>(SAMLPeerEntityContext.class));
- }
-
- /**
- * Set the strategy used to look up the {@link SecurityParametersContext} to set the parameters for.
- *
- * @param strategy lookup strategy
- */
- public void setSecurityParametersContextLookupStrategy(
- @Nonnull final Function<MessageContext, SecurityParametersContext> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- securityParametersContextLookupStrategy =
- Constraint.isNotNull(strategy, "SecurityParametersContext lookup strategy cannot be null");
- }
-
- /**
- * Set the strategy used to look up an existing {@link SecurityParametersContext} to copy instead of actually
- * resolving the parameters to set.
- *
- * @param strategy lookup strategy
- */
- public void setExistingParametersContextLookupStrategy(
- @Nullable final Function<MessageContext, SecurityParametersContext> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- existingParametersContextLookupStrategy = strategy;
- }
-
- /**
- * Set lookup strategy for {@link SAMLMetadataContext} for input to resolution.
- *
- * @param strategy lookup strategy
- */
- public void setMetadataContextLookupStrategy(
- @Nonnull final Function<MessageContext,SAMLMetadataContext> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- metadataContextLookupStrategy =
- Constraint.isNotNull(strategy, "SAMLMetadataContext lookup strategy cannot be null");
- }
-
- /**
- * Set lookup strategy for {@link OIDCMetadataContext} for input to resolution.
- *
- * @param strategy lookup strategy
- *
- * @since 3.1.0
- */
- public void setOidcMetadataContextLookupStrategy(
- @Nonnull final Function<MessageContext,OIDCMetadataContext> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- oidcMetadataContextLookupStrategy =
- Constraint.isNotNull(strategy, "OIDCMetadataContext lookup strategy cannot be null");
- }
-
- /**
- * Set the strategy used to look up a per-request {@link SignatureSigningConfiguration} list.
- *
- * @param strategy lookup strategy
- */
- public void setConfigurationLookupStrategy(
- @Nonnull final Function<MessageContext, List<SignatureSigningConfiguration>> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- configurationLookupStrategy =
- Constraint.isNotNull(strategy, "SignatureSigningConfiguration lookup strategy cannot be null");
- }
-
- /**
- * Set the resolver to use for the parameters to store into the context.
- *
- * @param newResolver resolver to use
- */
- public void setSignatureSigningParametersResolver(@Nonnull final SignatureSigningParametersResolver newResolver) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- resolver = Constraint.isNotNull(newResolver, "SignatureSigningParametersResolver cannot be null");
- }
-
- /**
- * Set whether a failure to resolve any parameters should be raised as an exception.
- *
- * <p>
- * Defaults to false.
- * </p>
- *
- * @param flag flag to set
- *
- * @since 3.4.0
- */
- public void setNoResultIsError(final boolean flag) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- noResultIsError = flag;
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
-
- if (resolver == null) {
- throw new ComponentInitializationException("SignatureSigningParametersResolver cannot be null");
- } else if (configurationLookupStrategy == null) {
- configurationLookupStrategy = new Function<MessageContext, List<SignatureSigningConfiguration>>() {
- public List<SignatureSigningConfiguration> apply(final MessageContext input) {
- return Collections
- .singletonList(SecurityConfigurationSupport.getGlobalSignatureSigningConfiguration());
- }
- };
- }
- }
-
- /** {@inheritDoc} */
- @Override
- protected boolean doPreInvoke(@Nonnull final MessageContext messageContext) throws MessageHandlerException {
-
- if (super.doPreInvoke(messageContext)) {
- log.debug("{} Signing enabled", getLogPrefix());
- return true;
- } else {
- log.debug("{} Signing not enabled", getLogPrefix());
- return false;
- }
- }
-
- // Checkstyle: CyclomaticComplexity|ReturnCount OFF
- /** {@inheritDoc} */
- @Override
- protected void doInvoke(@Nonnull final MessageContext messageContext) throws MessageHandlerException {
-
- log.debug("{} Resolving SignatureSigningParameters for request", getLogPrefix());
-
- final SecurityParametersContext paramsCtx = securityParametersContextLookupStrategy.apply(messageContext);
- if (paramsCtx == null) {
- log.debug("{} No SecurityParametersContext returned by lookup strategy", getLogPrefix());
- throw new MessageHandlerException("No SecurityParametersContext returned by lookup strategy");
- }
-
- if (existingParametersContextLookupStrategy != null) {
- final SecurityParametersContext existingCtx = existingParametersContextLookupStrategy.apply(messageContext);
- if (existingCtx != null && existingCtx.getSignatureSigningParameters() != null) {
- log.debug("{} Found existing SecurityParametersContext to copy from", getLogPrefix());
- paramsCtx.setSignatureSigningParameters(existingCtx.getSignatureSigningParameters());
- return;
- }
- }
-
- final List<SignatureSigningConfiguration> configs = configurationLookupStrategy.apply(messageContext);
- if (configs == null || configs.isEmpty()) {
- log.error("{} No SignatureSigningConfiguration returned by lookup strategy", getLogPrefix());
- throw new MessageHandlerException("No SignatureSigningConfiguration returned by lookup strategy");
- }
-
- final CriteriaSet criteria = new CriteriaSet(new SignatureSigningConfigurationCriterion(configs));
-
- final SAMLMetadataContext metadataCtx = metadataContextLookupStrategy.apply(messageContext);
- if (metadataCtx != null && metadataCtx.getRoleDescriptor() != null) {
- log.debug("{} Adding metadata to resolution criteria for signing/digest algorithms", getLogPrefix());
- criteria.add(new RoleDescriptorCriterion(metadataCtx.getRoleDescriptor()));
- }
-
- // The addition to {@link PopulateSignatureSigningParametersHandler}
- final OIDCMetadataContext oidcMetadataCtx = oidcMetadataContextLookupStrategy.apply(messageContext);
- if (oidcMetadataCtx != null && oidcMetadataCtx.getClientInformation() != null) {
- log.debug("{} Adding OIDC client information to resolution criteria for signing/digest algorithms",
- getLogPrefix());
- criteria.add(new ClientInformationCriterion(oidcMetadataCtx.getClientInformation()));
- } else {
- log.debug("{} OIDCMetadataContext is absent", getLogPrefix());
- }
-
- try {
- final SignatureSigningParameters params = resolver.resolveSingle(criteria);
- if (params == null && noResultIsError) {
- log.error("Failed to resolve SignatureSigningParameters");
- throw new MessageHandlerException("Failed to resolve SignatureSigningParameters");
- }
- log.debug("{} {} SignatureSigningParameters", getLogPrefix(),
- params != null ? "Resolved" : "Failed to resolve");
- paramsCtx.setSignatureSigningParameters(params);
- } catch (final ResolverException e) {
- log.error("{} Error resolving SignatureSigningParameters", getLogPrefix(), e);
- throw new MessageHandlerException("Error resolving SignatureSigningParameters", e);
- }
- }
- // Checkstyle: CyclomaticComplexity|ReturnCount ON
-
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SignIDToken.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SignIDToken.java
deleted file mode 100644
index 733c3066..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SignIDToken.java
+++ /dev/null
@@ -1,92 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.profile.impl;
-
-import javax.annotation.Nonnull;
-
-import org.opensaml.profile.action.ActionSupport;
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import com.nimbusds.jwt.JWTClaimsSet;
-import com.nimbusds.jwt.SignedJWT;
-import com.nimbusds.oauth2.sdk.ParseException;
-import com.nimbusds.openid.connect.sdk.claims.IDTokenClaimsSet;
-
-import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
-
-/**
- * Action that signs {@link IDTokenClaimsSet} and sets it to
- * {@link OIDCAuthenticationResponseContext#getProcessedToken}.
- * Actions exits silently if there are no signing parameters available.
- */
-public class SignIDToken extends AbstractSignJWTAction {
-
- /** Class logger. */
- @Nonnull
- private Logger log = LoggerFactory.getLogger(SignIDToken.class);
-
- /** token claims set to sign. */
- private JWTClaimsSet idTokenClaims;
-
- /** {@inheritDoc} */
- @Override
- protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
-
- if (!super.doPreExecute(profileRequestContext)) {
- return false;
- }
-
- if (getOidcResponseContext().getIDToken() == null) {
- log.error("{} No id token available", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
- return false;
- }
- try {
- idTokenClaims = getOidcResponseContext().getIDToken().toJWTClaimsSet();
- } catch (final ParseException e) {
- log.error("{} id token parsing failed {}", getLogPrefix(), e.getMessage());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
- return false;
- }
- return true;
- }
-
- /**
- * Sets id token claims as input for signing.
- *
- * @return id token claims.
- */
- @Override
- protected JWTClaimsSet getClaimsSetToSign() {
- return idTokenClaims;
- }
-
- /**
- * Set signed id token to response context.
- *
- * @param jwt signed id token.
- */
- @Override
- protected void setSignedJWT(final SignedJWT jwt) {
- getOidcResponseContext().setProcessedToken(jwt);
-
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/security/impl/OIDCClientInformationEncryptionParametersResolver.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/security/impl/OIDCClientInformationEncryptionParametersResolver.java
deleted file mode 100644
index daa183f4..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/security/impl/OIDCClientInformationEncryptionParametersResolver.java
+++ /dev/null
@@ -1,380 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.security.impl;
-
-import java.security.MessageDigest;
-import java.security.NoSuchAlgorithmException;
-import java.security.interfaces.ECPrivateKey;
-import java.security.interfaces.RSAPrivateKey;
-import java.time.Duration;
-import java.time.Instant;
-import java.util.List;
-import java.util.function.Predicate;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-import javax.crypto.SecretKey;
-import javax.crypto.spec.SecretKeySpec;
-
-import net.shibboleth.idp.plugin.oidc.op.criterion.ClientInformationCriterion;
-import net.shibboleth.oidc.jwk.RemoteJwkSetCache;
-import net.shibboleth.oidc.security.credential.BasicJWKCredential;
-import net.shibboleth.oidc.security.impl.OIDCDecryptionParameters;
-import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
-import net.shibboleth.utilities.java.support.resolver.ResolverException;
-
-import org.opensaml.security.credential.Credential;
-import org.opensaml.xmlsec.EncryptionConfiguration;
-import org.opensaml.xmlsec.EncryptionParameters;
-import org.opensaml.xmlsec.criterion.EncryptionConfigurationCriterion;
-import org.opensaml.xmlsec.criterion.EncryptionOptionalCriterion;
-import org.opensaml.xmlsec.impl.BasicEncryptionParametersResolver;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import com.nimbusds.jose.EncryptionMethod;
-import com.nimbusds.jose.JOSEException;
-import com.nimbusds.jose.JWEAlgorithm;
-import com.nimbusds.jose.jwk.JWK;
-import com.nimbusds.jose.jwk.JWKSet;
-import com.nimbusds.jose.jwk.KeyType;
-import com.nimbusds.jose.jwk.KeyUse;
-import com.nimbusds.jose.jwk.RSAKey;
-import com.nimbusds.oauth2.sdk.auth.Secret;
-import com.nimbusds.jose.jwk.ECKey;
-import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
-
-/**
- * A specialization of {@link BasicEncryptionParametersResolver} which resolves both encryption and decryption
- * credentials and algorithm preferences using client registration data of OIDC client. The credentials and algorithm
- * preferences are resolved for request object decryption, id token encryption and userinfo response encryption.
- *
- * <p>
- * In addition to the {@link net.shibboleth.utilities.java.support.resolver.Criterion} inputs documented in
- * {@link BasicEncryptionParametersResolver}, the inputs and associated modes of operation documented for
- * {@link ClientInformationCriterion} are also supported.
- * </p>
- *
- */
-public class OIDCClientInformationEncryptionParametersResolver extends BasicEncryptionParametersResolver {
-
- /** Logger. */
- private Logger log = LoggerFactory.getLogger(OIDCClientInformationEncryptionParametersResolver.class);
-
- /**
- * Whether to create parameters for request object decryption, id token encryption or userinfo response encryption.
- */
- public enum ParameterType {
-
- /** Type for request object decryption. */
- REQUEST_OBJECT_DECRYPTION,
-
- /** Type for id_token encryption. */
- IDTOKEN_ENCRYPTION,
-
- /** Type for user info encryption. */
- USERINFO_ENCRYPTION
- }
-
- /**
- * Whether to create parameters for request object decryption, id token encryption or userinfo response encryption.
- */
- private ParameterType target = ParameterType.IDTOKEN_ENCRYPTION;
-
- /** The cache for remote JWK key sets. */
- private RemoteJwkSetCache remoteJwkSetCache;
-
- /** The remote key refresh interval. Default value: 30 minutes. */
- @Positive
- private Duration keyFetchInterval = Duration.ofMinutes(30);
-
- /**
- * Constructor.
- */
- public OIDCClientInformationEncryptionParametersResolver() {
- super();
- }
-
- /**
- * Whether to create parameters for request object decryption, id token encryption or userinfo response encryption.
- *
- * @param value Whether to create parameters for request object decryption, id token encryption or userinfo
- * response encryption.
- */
- public void setParameterType(final ParameterType value) {
- target = value;
- }
-
- /**
- * Set the cache for remote JWK key sets.
- *
- * @param jwkSetCache What to set.
- */
- public void setRemoteJwkSetCache(final RemoteJwkSetCache jwkSetCache) {
- remoteJwkSetCache = Constraint.isNotNull(jwkSetCache, "The remote JWK set cache cannot be null");
- }
-
- /**
- * Set the remote key refresh interval.
- *
- * @param interval What to set.
- */
- public void setKeyFetchInterval(@Positive final Duration interval) {
- Constraint.isFalse(interval == null || interval.isNegative(), "Remote key refresh must be greater than 0");
- keyFetchInterval = interval;
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable
- public EncryptionParameters resolveSingle(@Nonnull final CriteriaSet criteria) throws ResolverException {
- Constraint.isNotNull(criteria, "CriteriaSet was null");
- Constraint.isNotNull(criteria.get(EncryptionConfigurationCriterion.class),
- "Resolver requires an instance of EncryptionConfigurationCriterion");
-
- final Predicate<String> includeExcludePredicate = getIncludeExcludePredicate(criteria);
-
- // For decryption we need to list all the located keys and need the extended EncryptionParameters
- final EncryptionParameters params = (target == ParameterType.REQUEST_OBJECT_DECRYPTION)
- ? new OIDCDecryptionParameters() : new EncryptionParameters();
-
- resolveAndPopulateCredentialsAndAlgorithms(params, criteria, includeExcludePredicate);
-
- boolean encryptionOptional = false;
- final EncryptionOptionalCriterion encryptionOptionalCrit = criteria.get(EncryptionOptionalCriterion.class);
- if (encryptionOptionalCrit != null) {
- encryptionOptional = encryptionOptionalCrit.isEncryptionOptional();
- }
-
- if (validate(params, encryptionOptional)) {
- logResult(params);
- return params;
- } else {
- return null;
- }
-
- }
-
- // Checkstyle: CyclomaticComplexity OFF
- // Checkstyle: MethodLength OFF
- // Checkstyle: ReturnCount OFF
-
- /** {@inheritDoc} */
- @Override
- protected void resolveAndPopulateCredentialsAndAlgorithms(@Nonnull final EncryptionParameters params,
- @Nonnull final CriteriaSet criteria, @Nonnull final Predicate<String> whitelistBlacklistPredicate) {
-
- if (!criteria.contains(ClientInformationCriterion.class)) {
- log.debug("No client criterion, falling back to local configuration");
- super.resolveAndPopulateCredentialsAndAlgorithms(params, criteria, whitelistBlacklistPredicate);
- return;
- }
-
- if (!criteria.contains(EncryptionConfigurationCriterion.class)) {
- log.debug("No encryption configuration criterion, falling back to default configuration");
- super.resolveAndPopulateCredentialsAndAlgorithms(params, criteria, whitelistBlacklistPredicate);
- return;
- }
-
- final List<EncryptionConfiguration> encryptionConfigurations =
- criteria.get(EncryptionConfigurationCriterion.class).getConfigurations();
- if (encryptionConfigurations == null || encryptionConfigurations.isEmpty()) {
- log.debug("No encryption configuration, falling back to default configuration");
- super.resolveAndPopulateCredentialsAndAlgorithms(params, criteria, whitelistBlacklistPredicate);
- return;
- }
-
- final OIDCClientInformation clientInformation =
- criteria.get(ClientInformationCriterion.class).getOidcClientInformation();
-
- // We populate the parameters only for the algorithm the client has registered
- JWEAlgorithm keyTransportAlgorithm = null;
- EncryptionMethod encryptionMethod = null;
- switch (target) {
- case REQUEST_OBJECT_DECRYPTION:
- keyTransportAlgorithm = clientInformation.getOIDCMetadata().getRequestObjectJWEAlg();
- encryptionMethod = clientInformation.getOIDCMetadata().getRequestObjectJWEEnc();
- break;
-
- case USERINFO_ENCRYPTION:
- keyTransportAlgorithm = clientInformation.getOIDCMetadata().getUserInfoJWEAlg();
- encryptionMethod = clientInformation.getOIDCMetadata().getUserInfoJWEEnc();
- break;
-
- default:
- keyTransportAlgorithm = clientInformation.getOIDCMetadata().getIDTokenJWEAlg();
- encryptionMethod = clientInformation.getOIDCMetadata().getIDTokenJWEEnc();
- }
- if (keyTransportAlgorithm == null) {
- log.debug("No algorithm information in client information, falling back to default configuration");
- super.resolveAndPopulateCredentialsAndAlgorithms(params, criteria, whitelistBlacklistPredicate);
- return;
- }
- // Default encEnc value
- if (encryptionMethod == null) {
- encryptionMethod = EncryptionMethod.A128CBC_HS256;
- }
- final List<String> keyTransportAlgorithms =
- getEffectiveKeyTransportAlgorithms(criteria, whitelistBlacklistPredicate);
- log.trace("Resolved effective key transport algorithms: {}", keyTransportAlgorithms);
- if (!keyTransportAlgorithms.contains(keyTransportAlgorithm.getName())) {
- log.warn("Client requests key transport algorithm {} that is not available",
- keyTransportAlgorithm.getName());
- super.resolveAndPopulateCredentialsAndAlgorithms(params, criteria, whitelistBlacklistPredicate);
- return;
- }
- final List<String> dataEncryptionAlgorithms =
- getEffectiveDataEncryptionAlgorithms(criteria, whitelistBlacklistPredicate);
- log.trace("Resolved effective data encryption algorithms: {}", dataEncryptionAlgorithms);
- if (!dataEncryptionAlgorithms.contains(encryptionMethod.getName())) {
- log.warn("Client requests encryption algorithm {} that is not available", encryptionMethod.getName());
- super.resolveAndPopulateCredentialsAndAlgorithms(params, criteria, whitelistBlacklistPredicate);
- return;
- }
- // for AES + client secret based key transports we generate secret key from client_secret
- if (JWEAlgorithm.Family.SYMMETRIC.contains(keyTransportAlgorithm)) {
- final Secret secret = clientInformation.getSecret();
- if (secret == null) {
- log.warn("No client secret available");
- super.resolveAndPopulateCredentialsAndAlgorithms(params, criteria, whitelistBlacklistPredicate);
- return;
- }
- final BasicJWKCredential jwkCredential = new BasicJWKCredential();
- jwkCredential.setAlgorithm(keyTransportAlgorithm);
- try {
- jwkCredential.setSecretKey(generateSymmetricKey(secret.getValueBytes(), keyTransportAlgorithm));
- } catch (final NoSuchAlgorithmException e) {
- log.warn("Unable to generate secret key: " + e.getMessage());
- super.resolveAndPopulateCredentialsAndAlgorithms(params, criteria, whitelistBlacklistPredicate);
- return;
- }
- if (params instanceof OIDCDecryptionParameters) {
- ((OIDCDecryptionParameters) params).getKeyTransportDecryptionCredentials().add(jwkCredential);
- }
- params.setKeyTransportEncryptionCredential(jwkCredential);
- params.setKeyTransportEncryptionAlgorithm(keyTransportAlgorithm.getName());
- params.setDataEncryptionAlgorithm(encryptionMethod.getName());
- return;
- }
- // For RSA & EC based encryption we pick one encryption key from client's registration data
- if (target != ParameterType.REQUEST_OBJECT_DECRYPTION) {
- final JWKSet keySet;
- if (clientInformation.getOIDCMetadata().getJWKSetURI() != null) {
- keySet = remoteJwkSetCache.fetch(clientInformation.getOIDCMetadata().getJWKSetURI(),
- Instant.now().plus(keyFetchInterval));
- } else {
- keySet = clientInformation.getOIDCMetadata().getJWKSet();
- }
- if (keySet == null) {
- log.warn("No keyset available");
- super.resolveAndPopulateCredentialsAndAlgorithms(params, criteria, whitelistBlacklistPredicate);
- return;
- }
- for (final JWK key : keySet.getKeys()) {
- if (KeyUse.SIGNATURE.equals(key.getKeyUse())) {
- continue;
- }
- if ((JWEAlgorithm.Family.RSA.contains(keyTransportAlgorithm) && key.getKeyType().equals(KeyType.RSA))
- || (JWEAlgorithm.Family.ECDH_ES.contains(keyTransportAlgorithm)
- && key.getKeyType().equals(KeyType.EC))) {
- final BasicJWKCredential jwkCredential = new BasicJWKCredential();
- jwkCredential.setAlgorithm(keyTransportAlgorithm);
- jwkCredential.setKid(key.getKeyID());
- try {
- if (key.getKeyType().equals(KeyType.RSA)) {
- jwkCredential.setPublicKey(((RSAKey) key).toPublicKey());
- } else {
- jwkCredential.setPublicKey(((ECKey) key).toPublicKey());
- }
- } catch (final JOSEException e) {
- log.warn("Unable to parse keyset");
- super.resolveAndPopulateCredentialsAndAlgorithms(params, criteria, whitelistBlacklistPredicate);
- return;
- }
- log.debug("Selected key {} for alg {} and enc {}", key.getKeyID(), keyTransportAlgorithm.getName(),
- encryptionMethod.getName());
- params.setKeyTransportEncryptionCredential(jwkCredential);
- params.setKeyTransportEncryptionAlgorithm(keyTransportAlgorithm.getName());
- params.setDataEncryptionAlgorithm(encryptionMethod.getName());
- return;
- }
- }
- } else {
- // For RSA & EC based decryption we pick all the possible decryption keys from security configuration
- for (final EncryptionConfiguration encryptionConfiguration : encryptionConfigurations) {
- for (final Credential credential : encryptionConfiguration.getKeyTransportEncryptionCredentials()) {
- if ((JWEAlgorithm.Family.RSA.contains(keyTransportAlgorithm)
- && credential.getPrivateKey() instanceof RSAPrivateKey)
- || (JWEAlgorithm.Family.ECDH_ES.contains(keyTransportAlgorithm)
- && credential.getPrivateKey() instanceof ECPrivateKey)) {
- log.debug("Picked key for alg {} and enc {}", keyTransportAlgorithm.getName(),
- encryptionMethod.getName());
- params.setKeyTransportEncryptionCredential(credential);
- params.setKeyTransportEncryptionAlgorithm(keyTransportAlgorithm.getName());
- params.setDataEncryptionAlgorithm(encryptionMethod.getName());
- if (params instanceof OIDCDecryptionParameters) {
- ((OIDCDecryptionParameters) params).getKeyTransportDecryptionCredentials().add(credential);
- continue;
- }
- return;
- }
-
- }
- }
- }
- if (params.getKeyTransportEncryptionCredential() == null) {
- log.debug("Not able to credentials based on provided client information");
- super.resolveAndPopulateCredentialsAndAlgorithms(params, criteria, whitelistBlacklistPredicate);
- }
- }
-
- // Checkstyle: CyclomaticComplexity ON
- // Checkstyle: MethodLength ON
- // Checkstyle: ReturnCount ON
-
- /**
- * Generate symmetric key from client secret.
- *
- * @param clientSecret client secret that is the basis of key
- * @param keyTransportAlgorithm algorithm the key is generated for
- * @return key derived from client secret.
- * @throws NoSuchAlgorithmException if algorithm or digest method is unsupported
- */
- private SecretKey generateSymmetricKey(final byte[] clientSecret, final JWEAlgorithm keyTransportAlgorithm)
- throws NoSuchAlgorithmException {
- final MessageDigest md = MessageDigest.getInstance("SHA-256");
- switch (keyTransportAlgorithm.getName()) {
- case "A128KW":
- case "A128GCMKW":
- return new SecretKeySpec(md.digest(clientSecret), 0, 16, "AES");
- case "A192KW":
- case "A192GCMKW":
- return new SecretKeySpec(md.digest(clientSecret), 0, 24, "AES");
- case "A256KW":
- case "A256GCMKW":
- return new SecretKeySpec(md.digest(clientSecret), 0, 32, "AES");
-
- default:
- }
- throw new NoSuchAlgorithmException(
- "Implementation does not support generating key for " + keyTransportAlgorithm.getName());
- }
-
-}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/security/impl/OIDCClientInformationSignatureSigningParametersResolver.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/security/impl/OIDCClientInformationSignatureSigningParametersResolver.java
deleted file mode 100644
index a4bad0f0..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/security/impl/OIDCClientInformationSignatureSigningParametersResolver.java
+++ /dev/null
@@ -1,224 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.security.impl;
-
-import java.security.interfaces.ECPrivateKey;
-import java.security.interfaces.RSAPrivateKey;
-import java.util.List;
-import java.util.function.Predicate;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-import javax.crypto.spec.SecretKeySpec;
-
-import net.shibboleth.idp.plugin.oidc.op.criterion.ClientInformationCriterion;
-import net.shibboleth.oidc.security.credential.BasicJWKCredential;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
-import net.shibboleth.utilities.java.support.resolver.ResolverException;
-
-import org.opensaml.security.credential.Credential;
-import org.opensaml.xmlsec.SignatureSigningParameters;
-import org.opensaml.xmlsec.criterion.SignatureSigningConfigurationCriterion;
-import org.opensaml.xmlsec.impl.BasicSignatureSigningParametersResolver;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import com.nimbusds.jose.JWSAlgorithm;
-import com.nimbusds.jose.jwk.Curve;
-import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
-
-/**
- * A specialization of {@link BasicSignatureSigningParametersResolver} which supports selecting signing credentials
- * based on client registration data and instantiating HS credentials when needed. If the resolver fails to resolve
- * credentials it leaves the job to the hands of the super class method.
- *
- * <p>
- * In addition to the {@link net.shibboleth.utilities.java.support.resolver.Criterion} inputs documented in
- * {@link BasicSignatureSigningParametersResolver}, the following inputs are also supported:
- * </p>
- * <ul>
- * <li>{@link ClientInformationCriterion} - optional</li>
- * </ul>
- */
-public class OIDCClientInformationSignatureSigningParametersResolver extends BasicSignatureSigningParametersResolver {
-
- /** Logger. */
- @Nonnull
- private Logger log = LoggerFactory.getLogger(OIDCClientInformationSignatureSigningParametersResolver.class);
-
- /**
- * Whether to create parameters for id token signing or userinfo response signing.
- */
- public enum ParameterType {
-
- /** Type for id_token signing. */
- IDTOKEN_SIGNING,
-
- /** Type for user info signing. */
- USERINFO_SIGNING
- }
-
- /** The type of signing: id_token or userinfo response. */
- private ParameterType target = ParameterType.IDTOKEN_SIGNING;
-
- /**
- * Whether to create parameters for id token signing or userinfo response signing.
- *
- * @param value Whether to create parameters for request object signature validation, id token signing or userinfo
- * response signing.
- *
- */
- public void setParameterType(final ParameterType value) {
- target = value;
- }
-
- /** {@inheritDoc} */
- @Nullable
- public SignatureSigningParameters resolveSingle(@Nonnull final CriteriaSet criteria) throws ResolverException {
- Constraint.isNotNull(criteria, "CriteriaSet was null");
- Constraint.isNotNull(criteria.get(SignatureSigningConfigurationCriterion.class),
- "Resolver requires an instance of SignatureSigningConfigurationCriterion");
-
- final Predicate<String> includeExcludePredicate = getIncludeExcludePredicate(criteria);
- final SignatureSigningParameters params = new SignatureSigningParameters();
-
- resolveAndPopulateCredentialAndSignatureAlgorithm(params, criteria, includeExcludePredicate);
-
- if (validate(params)) {
- logResult(params);
- return params;
- } else {
- return null;
- }
- }
-
- /**
- * Helper to match ECKey curve to JWS algorithm ES256, ES384 and ES512.
- *
- * @param curve curve to match.
- * @param algorithm algorithm to match.
- * @return true if key curve matches algorithm, otherwise false.
- */
- // TODO: Move to helper
- private boolean curveMatchesESAlgorithm(final Curve curve, final JWSAlgorithm algorithm) {
- if (algorithm.equals(JWSAlgorithm.ES256)) {
- return curve.equals(Curve.P_256);
- }
- if (algorithm.equals(JWSAlgorithm.ES384)) {
- return curve.equals(Curve.P_384);
- }
- if (algorithm.equals(JWSAlgorithm.ES512)) {
- return curve.equals(Curve.P_521);
- }
- return false;
- }
-
-// Checkstyle: CyclomaticComplexity|MethodLength OFF
- /** {@inheritDoc} */
- @Override
- protected void resolveAndPopulateCredentialAndSignatureAlgorithm(@Nonnull final SignatureSigningParameters params,
- @Nonnull final CriteriaSet criteria, @Nonnull final Predicate<String> whitelistBlacklistPredicate) {
-
- log.debug("Resolving SignatureSigningParameters, purpose {}",
- target.equals(ParameterType.IDTOKEN_SIGNING) ? "id token signing" : "userinfo response signing");
-
- if (!criteria.contains(ClientInformationCriterion.class)) {
- log.debug("No client criterion, nothing to do");
- super.resolveAndPopulateCredentialAndSignatureAlgorithm(params, criteria, whitelistBlacklistPredicate);
- return;
- }
- final OIDCClientInformation clientInformation =
- criteria.get(ClientInformationCriterion.class).getOidcClientInformation();
- if (clientInformation == null) {
- log.debug("No client information, nothing to do");
- super.resolveAndPopulateCredentialAndSignatureAlgorithm(params, criteria, whitelistBlacklistPredicate);
- return;
- }
- final List<Credential> credentials = getEffectiveSigningCredentials(criteria);
- final List<String> algorithms = getEffectiveSignatureAlgorithms(criteria, whitelistBlacklistPredicate);
- log.trace("Resolved effective signature algorithms: {}", algorithms);
- JWSAlgorithm algorithm =
- target == ParameterType.IDTOKEN_SIGNING ? clientInformation.getOIDCMetadata().getIDTokenJWSAlg()
- : clientInformation.getOIDCMetadata().getUserInfoJWSAlg();
- if (algorithm == null) {
- if (target == ParameterType.USERINFO_SIGNING) {
- log.debug("No alg defined in client information, nothing to do");
- super.resolveAndPopulateCredentialAndSignatureAlgorithm(params, criteria, whitelistBlacklistPredicate);
- return;
- }
- if (target == ParameterType.IDTOKEN_SIGNING) {
- algorithm = JWSAlgorithm.RS256;
- }
- }
- if (algorithm != null && !algorithms.contains(algorithm.getName())) {
- log.warn("Client requests algorithm {} that is not available", algorithm.getName());
- super.resolveAndPopulateCredentialAndSignatureAlgorithm(params, criteria, whitelistBlacklistPredicate);
- return;
- }
- // If HS family is requested we create the credential from client secret
- if (JWSAlgorithm.Family.HMAC_SHA.contains(algorithm)) {
- if (clientInformation.getSecret() == null) {
- log.warn("No client secret to use as a key");
- super.resolveAndPopulateCredentialAndSignatureAlgorithm(params, criteria, whitelistBlacklistPredicate);
- return;
- }
- final BasicJWKCredential jwkCredential = new BasicJWKCredential();
- jwkCredential.setSecretKey(new SecretKeySpec(clientInformation.getSecret().getValueBytes(), "NONE"));
- jwkCredential.setAlgorithm(algorithm);
- log.trace("HS Credential initialized from client secret for algorithm {}", algorithm.getName());
- params.setSigningCredential(jwkCredential);
- params.setSignatureAlgorithm(algorithm.getName());
- return;
- }
- // Lets pick first matching credential for the algorithm
- for (final Credential credential : credentials) {
- if ((JWSAlgorithm.Family.RSA.contains(algorithm) && (credential.getPrivateKey() instanceof RSAPrivateKey))
- || (JWSAlgorithm.Family.EC.contains(algorithm)
- && (credential.getPrivateKey() instanceof ECPrivateKey)
- && curveMatchesESAlgorithm(
- Curve.forECParameterSpec(
- ((java.security.interfaces.ECKey) credential.getPrivateKey()).getParams()),
- algorithm))) {
- log.trace("Credential picked for algorithm {}", algorithm.getName());
- params.setSigningCredential(credential);
- params.setSignatureAlgorithm(algorithm.getName());
- return;
- }
- }
-
- if (params.getSigningCredential() == null) {
- log.debug("Not able to resolve signing credential based on provided client information");
- super.resolveAndPopulateCredentialAndSignatureAlgorithm(params, criteria, whitelistBlacklistPredicate);
- }
- }
-// Checkstyle: CyclomaticComplexity|MethodLength ON
-
- /** {@inheritDoc} */
- @Override
- protected boolean validate(@Nonnull final SignatureSigningParameters params) {
- if (params.getSigningCredential() == null) {
- log.debug("Validation failure: Unable to resolve signing credential");
- return false;
- }
- if (params.getSignatureAlgorithm() == null) {
- log.debug("Validation failure: Unable to resolve signing algorithm URI");
- return false;
- }
- return true;
- }
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/security/impl/OIDCClientInformationSignatureValidationParametersResolver.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/security/impl/OIDCClientInformationSignatureValidationParametersResolver.java
deleted file mode 100644
index e03f7d4b..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/security/impl/OIDCClientInformationSignatureValidationParametersResolver.java
+++ /dev/null
@@ -1,307 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.security.impl;
-
-import java.time.Duration;
-import java.time.Instant;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.List;
-import java.util.function.Predicate;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-import javax.crypto.spec.SecretKeySpec;
-
-import net.shibboleth.idp.plugin.oidc.op.criterion.ClientInformationCriterion;
-import net.shibboleth.oidc.jwk.RemoteJwkSetCache;
-import net.shibboleth.oidc.security.credential.BasicJWKCredential;
-import net.shibboleth.oidc.security.impl.OIDCSignatureValidationParameters;
-import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
-import net.shibboleth.utilities.java.support.resolver.ResolverException;
-
-import org.opensaml.xmlsec.SignatureSigningParameters;
-import org.opensaml.xmlsec.criterion.SignatureSigningConfigurationCriterion;
-import org.opensaml.xmlsec.impl.BasicSignatureSigningParametersResolver;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import com.nimbusds.jose.JOSEException;
-import com.nimbusds.jose.JWSAlgorithm;
-import com.nimbusds.jose.jwk.Curve;
-import com.nimbusds.jose.jwk.ECKey;
-import com.nimbusds.jose.jwk.JWK;
-import com.nimbusds.jose.jwk.JWKSet;
-import com.nimbusds.jose.jwk.KeyUse;
-import com.nimbusds.jose.jwk.RSAKey;
-import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
-import com.nimbusds.jose.jwk.AsymmetricJWK;
-
-/**
- * A specialization of {@link BasicSignatureSigningParametersResolver} which supports selecting signature validation
- * credentials based on client registration data. If the resolver fails to resolve credentials it leaves the job to the
- * hands of the super class method.
- *
- * <p>
- * In addition to the {@link net.shibboleth.utilities.java.support.resolver.Criterion} inputs documented in
- * {@link BasicSignatureSigningParametersResolver}, the following inputs are also supported:
- * </p>
- * <ul>
- * <li>{@link ClientInformationCriterion} - optional</li>
- * </ul>
- */
-public class OIDCClientInformationSignatureValidationParametersResolver
- extends BasicSignatureSigningParametersResolver {
-
- /** Logger. */
- @Nonnull
- private Logger log = LoggerFactory.getLogger(OIDCClientInformationSignatureValidationParametersResolver.class);
-
- /**
- * Whether to create parameters for request object signature validation or token endpoint JWT validation.
- */
- public enum ParameterType {
-
- /** Type for request object validation. */
- REQUEST_OBJECT_VALIDATION,
-
- /** Type for token endpoint JWT validation. */
- TOKEN_ENDPOINT_JWT_VALIDATION;
- }
-
- /** The type of validation. */
- private ParameterType target = ParameterType.REQUEST_OBJECT_VALIDATION;
-
- /** The cache for remote JWK key sets. */
- private RemoteJwkSetCache remoteJwkSetCache;
-
- /** The remote key refresh interval. Default value: 30 minutes. */
- @Positive
- private Duration keyFetchInterval = Duration.ofMinutes(30);
-
- /**
- * Whether to create parameters for request object signature validation or token endpoint jwt validation.
- *
- * @param value Whether to create parameters for request object signature validation, id token signing or userinfo
- * response signing.
- */
- public void setParameterType(final ParameterType value) {
- target = value;
- }
-
- /**
- * Set the cache for remote JWK key sets.
- *
- * @param jwkSetCache What to set.
- */
- public void setRemoteJwkSetCache(final RemoteJwkSetCache jwkSetCache) {
- remoteJwkSetCache = Constraint.isNotNull(jwkSetCache, "The remote JWK set cache cannot be null");
- }
-
- /**
- * Set the remote key refresh interval.
- *
- * @param interval What to set.
- */
- public void setKeyFetchInterval(@Positive final Duration interval) {
- Constraint.isFalse(interval == null || interval.isNegative(), "Remote key refresh must be greater than 0");
- keyFetchInterval = interval;
- }
-
- /** {@inheritDoc} */
- @Nullable
- public SignatureSigningParameters resolveSingle(@Nonnull final CriteriaSet criteria) throws ResolverException {
- Constraint.isNotNull(criteria, "CriteriaSet was null");
- Constraint.isNotNull(criteria.get(SignatureSigningConfigurationCriterion.class),
- "Resolver requires an instance of SignatureSigningConfigurationCriterion");
-
- final Predicate<String> includeExcludePredicate = getIncludeExcludePredicate(criteria);
-
- // For signature validation we need to list all the located keys and need the extended
- // SignatureSigningParameters
- final SignatureSigningParameters params = new OIDCSignatureValidationParameters();
-
- resolveAndPopulateCredentialAndSignatureAlgorithm(params, criteria, includeExcludePredicate);
-
- if (validate(params)) {
- if (((OIDCSignatureValidationParameters) params).getValidationCredentials().size() == 0) {
- // Super class has resolved single credential, try resorting to that
- final BasicJWKCredential jwkCredential = new BasicJWKCredential();
- jwkCredential.setAlgorithm(JWSAlgorithm.parse(params.getSignatureAlgorithm()));
- jwkCredential.setPublicKey(params.getSigningCredential().getPublicKey());
- ((OIDCSignatureValidationParameters) params).getValidationCredentials().add(jwkCredential);
- }
- logResult(params);
- return params;
- } else {
- return null;
- }
- }
-
- /**
- * Helper to match ECKey curve to JWS algorithm ES256, ES384 and ES512.
- *
- * @param curve curve to match.
- * @param algorithm algorithm to match.
- * @return true if key curve matches algorithm, otherwise false.
- */
-
- // TODO: move to helper
- private boolean curveMatchesESAlgorithm(final Curve curve, final JWSAlgorithm algorithm) {
- if (algorithm.equals(JWSAlgorithm.ES256)) {
- return curve.equals(Curve.P_256);
- }
- if (algorithm.equals(JWSAlgorithm.ES384)) {
- return curve.equals(Curve.P_384);
- }
- if (algorithm.equals(JWSAlgorithm.ES512)) {
- return curve.equals(Curve.P_521);
- }
- return false;
- }
-
-// Checkstyle: CyclomaticComplexity|MethodLength OFF
- /** {@inheritDoc} */
- @Override
- protected void resolveAndPopulateCredentialAndSignatureAlgorithm(@Nonnull final SignatureSigningParameters params,
- @Nonnull final CriteriaSet criteria, @Nonnull final Predicate<String> whitelistBlacklistPredicate) {
-
- log.debug("Resolving SignatureSigningParameters, purpose {}",
- target.equals(ParameterType.REQUEST_OBJECT_VALIDATION) ? "request object signature validation"
- : "token endpoint jwt signature validation");
-
- if (!criteria.contains(ClientInformationCriterion.class)) {
- log.debug("No client criterion, nothing to do");
- super.resolveAndPopulateCredentialAndSignatureAlgorithm(params, criteria, whitelistBlacklistPredicate);
- return;
- }
- final OIDCClientInformation clientInformation =
- criteria.get(ClientInformationCriterion.class).getOidcClientInformation();
- if (clientInformation == null) {
- log.debug("No client information, nothing to do");
- super.resolveAndPopulateCredentialAndSignatureAlgorithm(params, criteria, whitelistBlacklistPredicate);
- return;
- }
- final List<String> algorithms = getEffectiveSignatureAlgorithms(criteria, whitelistBlacklistPredicate);
- log.trace("Resolved effective signature algorithms: {}", algorithms);
- final JWSAlgorithm algorithm = (target == ParameterType.REQUEST_OBJECT_VALIDATION)
- ? clientInformation.getOIDCMetadata().getRequestObjectJWSAlg()
- : clientInformation.getOIDCMetadata().getTokenEndpointAuthJWSAlg();
- if (algorithm != null && !algorithms.contains(algorithm.getName())) {
- log.warn("Client requests algorithm {} that is not available", algorithm.getName());
- super.resolveAndPopulateCredentialAndSignatureAlgorithm(params, criteria, whitelistBlacklistPredicate);
- return;
- }
-
- final List<JWSAlgorithm> supportedAlgos =
- algorithm == null ? convertToJWSAlgorithmList(algorithms) : Arrays.asList(algorithm);
- // Initialize HS family credentials
- for (final JWSAlgorithm alg : supportedAlgos) {
- if (JWSAlgorithm.Family.HMAC_SHA.contains(alg)) {
- if (clientInformation.getSecret() == null) {
- log.debug("No client secret to use as a key");
- break;
- }
- final BasicJWKCredential jwkCredential = new BasicJWKCredential();
- jwkCredential.setSecretKey(new SecretKeySpec(clientInformation.getSecret().getValueBytes(), "NONE"));
- jwkCredential.setAlgorithm(alg);
- log.trace("HS Credential initialized from client secret for algorithm {}", alg.getName());
- params.setSigningCredential(jwkCredential);
- params.setSignatureAlgorithm(alg.getName());
- ((OIDCSignatureValidationParameters) params).getValidationCredentials().add(jwkCredential);
- }
- }
- // For EC&RSA family signature validation we pick all suitable keys from client's registration data
- final JWKSet keySet;
- if (clientInformation.getOIDCMetadata().getJWKSetURI() != null) {
- keySet = remoteJwkSetCache.fetch(clientInformation.getOIDCMetadata().getJWKSetURI(),
- Instant.now().plus(keyFetchInterval));
- } else {
- keySet = clientInformation.getOIDCMetadata().getJWKSet();
- }
- if (keySet == null) {
- log.debug("No keyset available");
- } else {
- for (final JWK key : keySet.getKeys()) {
- if (KeyUse.ENCRYPTION.equals(key.getKeyUse())) {
- continue;
- }
- for (final JWSAlgorithm alg : supportedAlgos) {
- if ((JWSAlgorithm.Family.RSA.contains(alg) && key instanceof RSAKey)
- || (JWSAlgorithm.Family.EC.contains(alg) && key instanceof ECKey
- && curveMatchesESAlgorithm(((ECKey) key).getCurve(), alg))) {
- final BasicJWKCredential jwkCredential = new BasicJWKCredential();
- jwkCredential.setAlgorithm(alg);
- jwkCredential.setKid(key.getKeyID());
- try {
- jwkCredential.setPublicKey(((AsymmetricJWK) key).toPublicKey());
- } catch (final JOSEException e) {
- log.warn("Unable to parse key from keyset");
- continue;
- }
- log.debug("Selected key {} for alg {}", key.getKeyID(), alg.getName());
- params.setSigningCredential(jwkCredential);
- params.setSignatureAlgorithm(alg.getName());
- if (params instanceof OIDCSignatureValidationParameters) {
- ((OIDCSignatureValidationParameters) params).getValidationCredentials().add(jwkCredential);
- continue;
- }
- }
- }
- }
- }
- if (params.getSigningCredential() == null) {
- log.debug("Not able to resolve signature validation credential based on provided client information");
- super.resolveAndPopulateCredentialAndSignatureAlgorithm(params, criteria, whitelistBlacklistPredicate);
- }
- }
-// Checkstyle: CyclomaticComplexity|MethodLength ON
-
- /**
- * Convert algorithm string list to JWSAlgorithm list.
- *
- * @param algorithms algorithm string list
- * @return JWSAlgorithm list
- */
- private List<JWSAlgorithm> convertToJWSAlgorithmList(final List<String> algorithms) {
- final List<JWSAlgorithm> jwsList = new ArrayList<JWSAlgorithm>();
- if (algorithms == null) {
- return jwsList;
- }
- for (final String algorithm : algorithms) {
- jwsList.add(JWSAlgorithm.parse(algorithm));
- }
- return jwsList;
- }
-
- /** {@inheritDoc} */
- @Override
- protected boolean validate(@Nonnull final SignatureSigningParameters params) {
- if (params.getSigningCredential() == null) {
- log.debug("Validation failure: Unable to resolve signature validation credential");
- return false;
- }
- if (params.getSignatureAlgorithm() == null) {
- log.debug("Validation failure: Unable to resolve signature validation algorithm URI");
- return false;
- }
- return true;
- }
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/security/impl/package-info.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/security/impl/package-info.java
deleted file mode 100644
index b50a5285..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/security/impl/package-info.java
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * Classes related to signing, signature validation, encryption and decryption parameter resolution.
- */
-package net.shibboleth.idp.plugin.oidc.op.security.impl;
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/SignUserInfoResponse.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/SignUserInfoResponse.java
deleted file mode 100644
index 50652c2d..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/SignUserInfoResponse.java
+++ /dev/null
@@ -1,120 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.userinfo.profile.impl;
-
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.action.ActionSupport;
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import com.nimbusds.jose.JWSAlgorithm;
-import com.nimbusds.jwt.JWTClaimsSet;
-import com.nimbusds.jwt.SignedJWT;
-import com.nimbusds.oauth2.sdk.ParseException;
-import com.nimbusds.openid.connect.sdk.claims.UserInfo;
-
-import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultUserInfoSigningAlgLookupFunction;
-import net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractSignJWTAction;
-import net.shibboleth.utilities.java.support.component.ComponentSupport;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-
-/**
- * Action that signs {@link UserInfo} and sets it to {@link OIDCAuthenticationResponseContext#getProcessedToken}.
- * Actions exits silently if signing is not requested.
- */
-public class SignUserInfoResponse extends AbstractSignJWTAction {
-
- /** Class logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(SignUserInfoResponse.class);
-
- /** token claims set to sign. */
- @Nullable private JWTClaimsSet userInfoClaims;
-
- /** Strategy used to determine user info response signing algorithm. */
- @Nonnull private Function<ProfileRequestContext, JWSAlgorithm> userInfoSigAlgStrategy;
-
- /**
- * Constructor.
- */
- public SignUserInfoResponse() {
- userInfoSigAlgStrategy = new DefaultUserInfoSigningAlgLookupFunction();
- }
-
- /**
- * Set the strategy used to user info signing algorithm lookup strategy.
- *
- * @param strategy lookup strategy
- */
- public void setUserInfoSigningAlgLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,JWSAlgorithm> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- userInfoSigAlgStrategy =
- Constraint.isNotNull(strategy, "User Info Signing Algorithm lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- if (!super.doPreExecute(profileRequestContext) || userInfoSigAlgStrategy.apply(profileRequestContext) == null) {
- return false;
- }
-
- if (getOidcResponseContext().getUserInfo() == null) {
- log.error("{} No userinfo available", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
- return false;
- }
- try {
- userInfoClaims = getOidcResponseContext().getUserInfo().toJWTClaimsSet();
- } catch (final ParseException e) {
- log.error("{} userinfo parsing failed {}", getLogPrefix(), e.getMessage());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
- return false;
- }
- return true;
- }
-
- /**
- * Sets user info claims as input for signing.
- *
- * @return user info claims.
- */
- @Override
- protected JWTClaimsSet getClaimsSetToSign() {
- return userInfoClaims;
- }
-
- /**
- * Set signed user info to response context.
- *
- * @param jwt signed user info response.
- */
- @Override
- protected void setSignedJWT(final SignedJWT jwt) {
- getOidcResponseContext().setProcessedToken(jwt);
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-beans.xml
index abaf4bbb..aa6731bd 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-beans.xml
@@ -34,12 +34,17 @@
p:httpServletRequest-ref="shibboleth.oidc.internal.HttpServletRequest" />
<bean id="PopulateTokenEndpointJwtSignatureValidationParameters"
- class="net.shibboleth.idp.plugin.oidc.op.profile.impl.PopulateOIDCSignatureSigningParameters"
+ class="net.shibboleth.oidc.profile.impl.PopulateJWTSignatureValidationParameters"
scope="prototype"
- c:strategy-ref="shibboleth.MessageContextLookup.Inbound"
- p:configurationLookupStrategy-ref="shibboleth.oidc.SignatureValidationConfigurationLookup"
- p:signatureSigningParametersResolver-ref="shibboleth.oidc.TokenEndpointJwtSignatureValidationParametersResolver">
- <property name="securityParametersContextLookupStrategy">
+ c:strategy-ref="shibboleth.MessageContextLookup.Inbound">
+ <property name="configurationLookupStrategy">
+ <bean class="net.shibboleth.oidc.profile.config.navigate.JWTSignatureValidationConfigurationLookupFunction"
+ p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
+ </property>
+ <property name="signatureValidationParametersResolver">
+ <bean class="net.shibboleth.oidc.security.impl.BasicJWTSignatureValidationParametersResolver" />
+ </property>
+<!-- <property name="securityParametersContextLookupStrategy">
<bean parent="shibboleth.Functions.Compose"
c:g-ref="shibboleth.ChildLookupOrCreate.SecurityParameters"
c:f-ref="shibboleth.ChildLookup.RelyingParty" />
@@ -48,18 +53,35 @@
<bean parent="shibboleth.Functions.Compose"
c:g-ref="shibboleth.ChildLookup.SecurityParameters"
c:f-ref="shibboleth.MessageContextLookup.Outbound" />
- </property>
+ </property>-->
</bean>
- <bean id="shibboleth.oidc.SignatureValidationConfigurationLookup"
- class="net.shibboleth.oidc.profile.config.navigate.TokenEndpointJwtSignatureValidationConfigurationLookupFunction"
- p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
+ <bean id="JWTAuthenticationCondition" parent="shibboleth.Conditions.Expression"
+ c:expression="#input.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).getSubcontext(T(net.shibboleth.oidc.authn.context.OAuth2ClientAuthenticationContext)).getClientAuthentication() instanceof T(com.nimbusds.oauth2.sdk.auth.JWTAuthentication)" />
+
+ <bean id="TempAdaptor" class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor"
+ scope="prototype" c:executionDirection="INBOUND" p:activationCondition-ref="JWTAuthenticationCondition"
+ p:errorEvent="#{T(net.shibboleth.idp.authn.AuthnEventIds).AUTHN_EXCEPTION}">
+ <constructor-arg name="messageHandler">
+ <bean class="net.shibboleth.oidc.security.impl.JWTMessageSignatureSecurityHandler"
+ scope="prototype">
+ <property name="jwtTokenLookupStrategy">
+ <bean
+ class="net.shibboleth.idp.profile.context.navigate.SpringExpressionContextLookupFunction"
+ c:_0="#{ T(org.opensaml.messaging.context.MessageContext) }"
+ c:outputType="#{T(com.nimbusds.jwt.SignedJWT)}"
+ c:expression="#input.getParent().getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).getSubcontext(T(net.shibboleth.oidc.authn.context.OAuth2ClientAuthenticationContext)).getClientAuthentication().getClientAssertion()" />
+ </property>
+ <property name="clientInformationLookupStrategy">
+ <bean
+ class="net.shibboleth.idp.profile.context.navigate.SpringExpressionContextLookupFunction"
+ c:_0="#{ T(org.opensaml.messaging.context.MessageContext) }"
+ c:expression="#input.getSubcontext(T(net.shibboleth.oidc.metadata.context.OIDCMetadataContext)).getClientInformation()" />
+ </property>
+ </bean>
+ </constructor-arg>
+ </bean>
- <bean id="shibboleth.oidc.TokenEndpointJwtSignatureValidationParametersResolver"
- class="net.shibboleth.idp.plugin.oidc.op.security.impl.OIDCClientInformationSignatureValidationParametersResolver"
- p:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache"
- p:keyFetchInterval="%{idp.oidc.jwksuri.fetchInterval:PT30M}"
- p:parameterType="#{T(net.shibboleth.idp.plugin.oidc.op.security.impl.OIDCClientInformationSignatureValidationParametersResolver.ParameterType).TOKEN_ENDPOINT_JWT_VALIDATION}" />
<bean id="ValidateClientAuthenticationType"
class="net.shibboleth.idp.plugin.oidc.op.authn.impl.ValidateClientAuthenticationType" scope="prototype" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-flow.xml
index d5ace10c..c643437f 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-flow.xml
@@ -12,6 +12,7 @@
<evaluate expression="PopulateTokenEndpointJwtSignatureValidationParameters"/>
<evaluate expression="ExtractClientAuthenticationFromRequest" />
<evaluate expression="ValidateClientAuthenticationType" />
+ <evaluate expression="TempAdaptor"/>
<evaluate expression="ValidateCredentials" />
<evaluate expression="PopulateSubjectCanonicalizationContext" />
<evaluate expression="'proceed'" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml
index 7d03e4c6..4092176a 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml
@@ -20,9 +20,6 @@
p:loggingId-ref="shibboleth.oidc.loggingId"
p:browserProfile-ref="shibboleth.oidc.browserProfile" />
- <bean id="shibboleth.oidc.TokenSignatureSigningParametersResolver"
- class="net.shibboleth.idp.plugin.oidc.op.security.impl.OIDCClientInformationSignatureSigningParametersResolver" />
-
<bean id="SelectRelyingPartyConfiguration"
class="net.shibboleth.idp.profile.impl.SelectRelyingPartyConfiguration" scope="prototype"
p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
@@ -112,4 +109,14 @@
</constructor-arg>
</bean>
+ <bean id="shibboleth.oidc.ChildLookup.JWTSecurityParameters"
+ class="org.opensaml.messaging.context.navigate.ChildContextLookup"
+ c:type="#{ T(net.shibboleth.oidc.security.context.JWTSecurityParametersContext) }"
+ c:createContext="false" />
+
+ <bean id="shibboleth.oidc.ChildLookupOrCreate.JWTSecurityParameters"
+ class="org.opensaml.messaging.context.navigate.ChildContextLookup"
+ c:type="#{ T(net.shibboleth.oidc.security.context.JWTSecurityParametersContext) }"
+ c:createContext="true" />
+
</beans>
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
index 9da0b1f8..f20f124c 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
@@ -83,48 +83,31 @@
scope="prototype" />
<bean id="PopulateRequestObjectDecryptionParameters"
- class="net.shibboleth.idp.plugin.oidc.op.profile.impl.PopulateOIDCEncryptionParameters" scope="prototype"
- p:configurationLookupStrategy-ref="shibboleth.oidc.DecryptionConfigurationLookup"
- p:encryptionParametersResolver-ref="shibboleth.oidc.EncryptionParametersResolverForRequestObjectDecryption"
- p:forDecryption="true" />
-
- <bean id="shibboleth.oidc.EncryptionParametersResolverForRequestObjectDecryption"
- class="net.shibboleth.idp.plugin.oidc.op.security.impl.OIDCClientInformationEncryptionParametersResolver"
- p:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache"
- p:keyFetchInterval="%{idp.oidc.jwksuri.fetchInterval:PT30M}"
- p:parameterType="#{T(net.shibboleth.idp.plugin.oidc.op.security.impl.OIDCClientInformationEncryptionParametersResolver.ParameterType).REQUEST_OBJECT_DECRYPTION}" />
-
- <bean id="shibboleth.oidc.DecryptionConfigurationLookup"
- class="net.shibboleth.oidc.profile.config.navigate.RequestObjectDecryptionConfigurationLookupFunction"
+ class="net.shibboleth.oidc.profile.impl.PopulateJWTDecryptionParameters" scope="prototype"
+ p:configurationLookupStrategy-ref="DecryptionConfigurationLookup"
+ p:decryptionParametersResolver-ref="JWTDecryptionParametersResolver" />
+
+
+ <bean id="DecryptionConfigurationLookup" lazy-init="true"
+ class="net.shibboleth.oidc.profile.config.navigate.JWTDecryptionConfigurationLookupFunction"
p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
+ <bean id="JWTDecryptionParametersResolver"
+ class="net.shibboleth.oidc.security.impl.DefaultJWTDecryptionParametersResolver" />
+
<bean id="PopulateRequestObjectSignatureValidationParameters"
- class="net.shibboleth.idp.plugin.oidc.op.profile.impl.PopulateOIDCSignatureSigningParameters " scope="prototype"
- c:strategy-ref="shibboleth.MessageContextLookup.Inbound"
- p:configurationLookupStrategy-ref="shibboleth.oidc.SignatureValidationConfigurationLookup"
- p:signatureSigningParametersResolver-ref="shibboleth.oidc.RequestObjectSignatureValidationParametersResolver">
- <property name="securityParametersContextLookupStrategy">
- <bean parent="shibboleth.Functions.Compose"
- c:g-ref="shibboleth.ChildLookupOrCreate.SecurityParameters"
- c:f-ref="shibboleth.ChildLookup.RelyingParty" />
+ class="net.shibboleth.oidc.profile.impl.PopulateJWTSignatureValidationParameters"
+ scope="prototype"
+ c:strategy-ref="shibboleth.MessageContextLookup.Inbound">
+ <property name="configurationLookupStrategy">
+ <bean class="net.shibboleth.oidc.profile.config.navigate.JWTSignatureValidationConfigurationLookupFunction"
+ p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
</property>
- <property name="existingParametersContextLookupStrategy">
- <bean parent="shibboleth.Functions.Compose"
- c:g-ref="shibboleth.ChildLookup.SecurityParameters"
- c:f-ref="shibboleth.MessageContextLookup.Outbound" />
+ <property name="signatureValidationParametersResolver">
+ <bean class="net.shibboleth.oidc.security.impl.BasicJWTSignatureValidationParametersResolver" />
</property>
</bean>
- <bean id="shibboleth.oidc.SignatureValidationConfigurationLookup"
- class="net.shibboleth.oidc.profile.config.navigate.RequestObjectSignatureValidationConfigurationLookupFunction"
- p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
-
- <bean id="shibboleth.oidc.RequestObjectSignatureValidationParametersResolver"
- class="net.shibboleth.idp.plugin.oidc.op.security.impl.OIDCClientInformationSignatureValidationParametersResolver"
- p:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache"
- p:keyFetchInterval="%{idp.oidc.jwksuri.fetchInterval:PT30M}"
- p:parameterType="#{T(net.shibboleth.idp.plugin.oidc.op.security.impl.OIDCClientInformationSignatureValidationParametersResolver.ParameterType).REQUEST_OBJECT_VALIDATION}" />
-
<bean id="SetRequestObjectToResponseContext"
class="net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.SetRequestObjectToResponseContext" scope="prototype"
p:httpClient="#{getObject('shibboleth.oidc.NonBrowser.HttpClient') ?: getObject('shibboleth.InternalHttpClient')}"
@@ -133,15 +116,35 @@
<bean id="DecryptRequestObject" class="net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.DecryptRequestObject"
scope="prototype" />
+ <bean id="RequestObjectSignedCondition" parent="shibboleth.Conditions.Expression"
+ c:expression="#input.getOutboundMessageContext().getSubcontext(T(net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext)).getRequestObject() instanceof T(com.nimbusds.jwt.SignedJWT)" />
+
+ <bean id="ValidateRequestObjectSignature" class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor"
+ scope="prototype" c:executionDirection="INBOUND" p:activationCondition-ref="RequestObjectSignedCondition">
+ <constructor-arg name="messageHandler">
+ <bean class="net.shibboleth.oidc.security.impl.JWTMessageSignatureSecurityHandler"
+ scope="prototype">
+ <property name="jwtTokenLookupStrategy">
+ <bean
+ class="net.shibboleth.idp.profile.context.navigate.SpringExpressionContextLookupFunction"
+ c:_0="#{ T(org.opensaml.messaging.context.MessageContext) }"
+ c:outputType="#{T(com.nimbusds.jwt.SignedJWT)}"
+ c:expression="#input.getParent().getOutboundMessageContext().getSubcontext(T(net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext)).getRequestObject()" />
+ </property>
+ <property name="clientInformationLookupStrategy">
+ <bean
+ class="net.shibboleth.idp.profile.context.navigate.SpringExpressionContextLookupFunction"
+ c:_0="#{ T(org.opensaml.messaging.context.MessageContext) }"
+ c:expression="#input.getSubcontext(T(net.shibboleth.oidc.metadata.context.OIDCMetadataContext)).getClientInformation()" />
+ </property>
+ </bean>
+ </constructor-arg>
+ </bean>
+
<bean id="ValidateRequestObject" class="net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.ValidateRequestObject"
scope="prototype"
p:plainClaimsValidator-ref="shibboleth.oidc.PlainRequestObjectClaimsValidation"
p:signedClaimsValidator-ref="shibboleth.oidc.SignedRequestObjectClaimsValidation">
- <property name="securityParametersLookupStrategy">
- <bean parent="shibboleth.Functions.Compose"
- c:g-ref="shibboleth.ChildLookup.SecurityParameters"
- c:f-ref="shibboleth.ChildLookup.RelyingParty" />
- </property>
</bean>
<bean id="shibboleth.oidc.PlainRequestObjectClaimsValidation"
@@ -211,10 +214,6 @@
<bean id="AuthenticationRequestAudienceLookupStrategy"
class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestAudienceLookupFunction" />
- <bean id="shibboleth.oidc.EncryptionParametersResolver"
- class="net.shibboleth.idp.plugin.oidc.op.security.impl.OIDCClientInformationEncryptionParametersResolver"
- p:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache" p:keyFetchInterval="%{idp.oidc.jwksuri.fetchInterval:PT30M}" />
-
<bean id="PopulateClientStorageLoadContext"
class="org.opensaml.storage.impl.client.PopulateClientStorageLoadContext" scope="prototype"
p:storageServices="#{ getObject('shibboleth.ClientStorageServices') ?: getObject('shibboleth.DefaultClientStorageServices') }" />
@@ -418,14 +417,19 @@
<!-- If access token is strictly for UserInfo endpoint... -->
<bean id="PopulateUserInfoAccessTokenSignatureSigningParameters"
- class="net.shibboleth.idp.plugin.oidc.op.profile.impl.PopulateOIDCSignatureSigningParameters"
- scope="prototype"
- c:strategy-ref="shibboleth.MessageContextLookup.Inbound"
- p:configurationLookupStrategy-ref="shibboleth.SignatureSigningConfigurationLookup"
- p:signatureSigningParametersResolver-ref="shibboleth.oidc.TokenSignatureSigningParametersResolver">
+ class="net.shibboleth.oidc.profile.impl.PopulateJWTSignatureSigningParameters" scope="prototype"
+ c:strategy-ref="shibboleth.MessageContextLookup.Outbound">
+ <property name="configurationLookupStrategy">
+ <bean lazy-init="true"
+ class="net.shibboleth.oidc.profile.config.navigate.JWTSignatureSigningConfigurationLookupFunction"
+ p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
+ </property>
+ <property name="signatureSigningParametersResolver">
+ <bean class="net.shibboleth.oidc.security.impl.BasicJWTSignatureSigningParametersResolver" />
+ </property>
<property name="securityParametersContextLookupStrategy">
<bean parent="shibboleth.Functions.Compose"
- c:g-ref="shibboleth.ChildLookupOrCreate.SecurityParameters"
+ c:g-ref="shibboleth.oidc.ChildLookupOrCreate.JWTSecurityParameters"
c:f-ref="shibboleth.ChildLookup.RelyingParty" />
</property>
</bean>
@@ -439,16 +443,24 @@
c:g-ref="shibboleth.ClientIDLookupStrategy"
c:f-ref="shibboleth.MessageContextLookup.Inbound" />
- <bean id="SignOIDCAccessToken"
- class="net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.SignAccessToken" scope="prototype"
- p:typeHeader="at+jwt">
- <property name="securityParametersLookupStrategy">
- <bean parent="shibboleth.Functions.Compose"
- c:g-ref="shibboleth.ChildLookup.SecurityParameters"
- c:f-ref="shibboleth.ChildLookup.RelyingParty" />
- </property>
+ <bean id="SignOIDCAccessToken" class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor"
+ scope="prototype" c:executionDirection="OUTBOUND ">
+ <constructor-arg name="messageHandler">
+ <bean id="SignOIDCAccessTokenHandler"
+ class="net.shibboleth.oidc.security.impl.SignJWTHandler" scope="prototype" p:logName="Access Token"
+ p:typeHeader="at+jwt">
+ <property name="claimsToSignLookupStrategy">
+ <bean
+ class="net.shibboleth.idp.plugin.oidc.op.messaging.context.logic.JWTClaimsSetFromJWTAccessTokenLookupFunction" />
+ </property>
+ <property name="jwtUpdateConsumer">
+ <bean
+ class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.JWTAccessTokenUpdateStrategy" />
+ </property>
+ </bean>
+ </constructor-arg>
</bean>
-
+
<bean id="SetOAuthAccessTokenToResponseContext"
class="net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.SetAccessTokenToResponseContext"
scope="prototype" />
@@ -456,17 +468,31 @@
<!-- If access token is also for third-party resource... -->
<bean id="PopulateThirdPartyAccessTokenSignatureSigningParameters"
- class="net.shibboleth.idp.plugin.oidc.op.profile.impl.PopulateOIDCSignatureSigningParameters"
+ class="net.shibboleth.oidc.profile.impl.PopulateJWTSignatureSigningParameters"
scope="prototype"
- c:strategy-ref="shibboleth.MessageContextLookup.Outbound"
- p:configurationLookupStrategy-ref="shibboleth.SignatureSigningConfigurationLookup"
- p:signatureSigningParametersResolver-ref="shibboleth.oidc.TokenSignatureSigningParametersResolver"
- p:securityParametersContextLookupStrategy-ref="AudienceSecurityParametersCreationStrategy" />
+ p:securityParametersContextLookupStrategy-ref="AudienceSecurityParametersCreationStrategy"
+ c:strategy-ref="shibboleth.MessageContextLookup.Outbound">
+ <property name="configurationLookupStrategy">
+ <bean lazy-init="true"
+ class="net.shibboleth.oidc.profile.config.navigate.JWTSignatureSigningConfigurationLookupFunction"
+ p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
+ </property>
+ <property name="signatureSigningParametersResolver">
+ <bean class="net.shibboleth.oidc.security.impl.BasicJWTSignatureSigningParametersResolver" />
+ </property>
+ </bean>
<bean id="AudienceSecurityParametersCreationStrategy" parent="shibboleth.Functions.Compose"
- c:g-ref="shibboleth.ChildLookupOrCreate.SecurityParameters"
+ c:g-ref="shibboleth.oidc.ChildLookupOrCreate.JWTSecurityParameters"
c:f-ref="AudienceRelyingPartyCreationStrategy" />
+ <bean id="AudienceSecurityParametersCreationViaMessageContextStrategy" parent="shibboleth.Functions.Compose">
+ <constructor-arg name="g" ref="AudienceSecurityParametersCreationStrategy" />
+ <constructor-arg name="f">
+ <bean parent="shibboleth.Functions.Expression" c:expression="#input.getParent()" />
+ </constructor-arg>
+ </bean>
+
<bean id="AddAttributeClaimsToAccessToken"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.AddAttributesToClaimsSet" scope="prototype"
p:transcoderRegistry-ref="shibboleth.AttributeRegistryService"
@@ -493,34 +519,80 @@
class="net.shibboleth.oidc.profile.config.navigate.AccessTokenLifetimeLookupFunction"
p:relyingPartyContextLookupStrategy-ref="AudienceRelyingPartyCreationStrategy" />
- <bean id="SignAccessToken"
+<!-- <bean id="SignAccessToken"
class="net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.SignAccessToken" scope="prototype"
p:securityParametersLookupStrategy-ref="AudienceSecurityParametersCreationStrategy"
p:typeHeader="at+jwt" />
-
+ -->
+ <bean id="SignAccessToken" class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor"
+ scope="prototype" c:executionDirection="OUTBOUND ">
+ <constructor-arg name="messageHandler">
+ <bean id="SignAccessTokenHandler"
+ class="net.shibboleth.oidc.security.impl.SignJWTHandler" scope="prototype" p:logName="Access Token"
+ p:securityParametersLookupStrategy-ref="AudienceSecurityParametersCreationViaMessageContextStrategy"
+ p:typeHeader="at+jwt">
+ <property name="claimsToSignLookupStrategy">
+ <bean
+ class="net.shibboleth.idp.plugin.oidc.op.messaging.context.logic.JWTClaimsSetFromJWTAccessTokenLookupFunction" />
+ </property>
+ <property name="jwtUpdateConsumer">
+ <bean
+ class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.JWTAccessTokenUpdateStrategy" />
+ </property>
+ </bean>
+ </constructor-arg>
+ </bean>
<!-- ID token actions. -->
<bean id="PopulateIDTokenSignatureSigningParameters"
- class="net.shibboleth.idp.plugin.oidc.op.profile.impl.PopulateOIDCSignatureSigningParameters " scope="prototype"
- c:strategy-ref="shibboleth.MessageContextLookup.Inbound"
- p:configurationLookupStrategy-ref="shibboleth.SignatureSigningConfigurationLookup"
- p:signatureSigningParametersResolver-ref="shibboleth.oidc.TokenSignatureSigningParametersResolver">
- <property name="securityParametersContextLookupStrategy">
- <bean parent="shibboleth.Functions.Compose"
- c:g-ref="shibboleth.ChildLookupOrCreate.SecurityParameters"
- c:f-ref="shibboleth.ChildLookup.RelyingParty" />
+ class="net.shibboleth.oidc.profile.impl.PopulateJWTSignatureSigningParameters" scope="prototype"
+ c:strategy-ref="shibboleth.MessageContextLookup.Outbound">
+ <property name="configurationLookupStrategy">
+ <bean lazy-init="true"
+ class="net.shibboleth.oidc.profile.config.navigate.JWTSignatureSigningConfigurationLookupFunction"
+ p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
</property>
- <property name="existingParametersContextLookupStrategy">
- <bean parent="shibboleth.Functions.Compose"
- c:g-ref="shibboleth.ChildLookup.SecurityParameters"
- c:f-ref="shibboleth.MessageContextLookup.Outbound" />
+ <property name="signatureSigningParametersResolver">
+ <bean class="net.shibboleth.oidc.security.impl.BasicJWTSignatureSigningParametersResolver" />
</property>
</bean>
<bean id="PopulateIDTokenEncryptionParameters"
- class="net.shibboleth.idp.plugin.oidc.op.profile.impl.PopulateOIDCEncryptionParameters" scope="prototype"
- p:configurationLookupStrategy-ref="shibboleth.EncryptionConfigurationLookup"
- p:encryptionParametersResolver-ref="shibboleth.oidc.EncryptionParametersResolver" />
+ class="net.shibboleth.oidc.profile.impl.PopulateJWTEncryptionParameters" scope="prototype"
+ p:forFriendlyName="ID Token">
+ <property name="clientMetadataContextLookupStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultOIDCMetadataContextLookupFunction"
+ p:inbound="true" />
+ </property>
+ <property name="configurationLookupStrategy">
+ <bean lazy-init="true"
+ class="net.shibboleth.oidc.profile.config.navigate.JWTEncryptionConfigurationLookupFunction"
+ p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
+ </property>
+ <property name="encryptionParametersResolver">
+ <bean class="net.shibboleth.oidc.security.impl.DefaultJWTEncryptionParametersResolver">
+ <property name="keyTransportEncryptionAlgorithmsLookupStrategy">
+ <bean
+ class="net.shibboleth.oidc.security.impl.ClientInformationKeyTransportEncryptionAlgorithmsLookupStrategy">
+ <constructor-arg>
+ <bean
+ class="net.shibboleth.oidc.profile.config.navigate.ClientInformationStringValueLookupFunction"
+ c:keyName="id_token_encrypted_response_alg" />
+ </constructor-arg>
+ </bean>
+ </property>
+ <property name="dataEncryptionAlgorithmsLookupStrategy">
+ <bean class="net.shibboleth.oidc.security.impl.ClientInformationDataEncryptionAlgorithmsLookupStrategy">
+ <constructor-arg>
+ <bean
+ class="net.shibboleth.oidc.profile.config.navigate.ClientInformationStringValueLookupFunction"
+ c:keyName="id_token_encrypted_response_enc" />
+ </constructor-arg>
+ </bean>
+ </property>
+ </bean>
+ </property>
+ </bean>
<bean id="AddIDTokenShell" class="net.shibboleth.idp.plugin.oidc.op.profile.impl.AddIDTokenShell" scope="prototype" />
@@ -543,7 +615,7 @@
p:activationCondition-ref="AccessTokenRequested">
<property name="securityParametersLookupStrategy">
<bean parent="shibboleth.Functions.Compose"
- c:g-ref="shibboleth.ChildLookup.SecurityParameters"
+ c:g-ref="shibboleth.oidc.ChildLookup.JWTSecurityParameters"
c:f-ref="shibboleth.ChildLookup.RelyingParty" />
</property>
</bean>
@@ -553,14 +625,14 @@
p:activationCondition-ref="AuthorizeCodeRequested">
<property name="securityParametersLookupStrategy">
<bean parent="shibboleth.Functions.Compose"
- c:g-ref="shibboleth.ChildLookup.SecurityParameters"
+ c:g-ref="shibboleth.oidc.ChildLookup.JWTSecurityParameters"
c:f-ref="shibboleth.ChildLookup.RelyingParty" />
</property>
<property name="codeHashCalculationStrategy">
<bean class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultComputeAuthorizationCodeHashFunction">
<property name="securityParametersLookupStrategy">
<bean parent="shibboleth.Functions.Compose"
- c:g-ref="shibboleth.ChildLookup.SecurityParameters"
+ c:g-ref="shibboleth.oidc.ChildLookup.JWTSecurityParameters"
c:f-ref="shibboleth.ChildLookup.RelyingParty" />
</property>
<property name="authorizationCodeLookupStrategy">
@@ -573,16 +645,40 @@
<bean id="ManipulateClaimsForIDToken"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.ManipulateClaimsForIDToken" scope="prototype" />
- <bean id="SignIDToken" class="net.shibboleth.idp.plugin.oidc.op.profile.impl.SignIDToken" scope="prototype">
- <property name="securityParametersLookupStrategy">
- <bean parent="shibboleth.Functions.Compose"
- c:g-ref="shibboleth.ChildLookup.SecurityParameters"
- c:f-ref="shibboleth.ChildLookup.RelyingParty" />
- </property>
+ <bean id="SignIDToken" class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor"
+ scope="prototype" c:executionDirection="OUTBOUND ">
+ <constructor-arg name="messageHandler">
+ <bean id="SignIDTokenHandler"
+ class="net.shibboleth.oidc.security.impl.SignJWTHandler" scope="prototype" p:logName="ID Token">
+ <property name="claimsToSignLookupStrategy">
+ <bean
+ class="net.shibboleth.idp.plugin.oidc.op.messaging.context.logic.JWTClaimsSetFromIDTokenLookupFunction" />
+ </property>
+ <property name="jwtUpdateConsumer">
+ <bean
+ class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.ProcessedTokenUpdateStrategy" />
+ </property>
+ </bean>
+ </constructor-arg>
</bean>
- <bean id="EncryptIDToken" class="net.shibboleth.idp.plugin.oidc.op.profile.impl.EncryptProcessedToken"
- scope="prototype" />
+ <bean id="EncryptIDToken" class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor"
+ scope="prototype" c:executionDirection="OUTBOUND">
+ <constructor-arg name="messageHandler">
+ <bean id="EncryptIDTokenHandler"
+ class="net.shibboleth.oidc.security.impl.EncryptJWTHandler" scope="prototype"
+ p:logName="ID Token">
+ <property name="payloadToEncryptLookupStrategy">
+ <bean
+ class="net.shibboleth.idp.plugin.oidc.op.messaging.context.logic.PayloadFromProcessedTokenLookupFunction" />
+ </property>
+ <property name="jwtUpdateConsumer">
+ <bean
+ class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.ProcessedTokenUpdateStrategy" />
+ </property>
+ </bean>
+ </constructor-arg>
+ </bean>
<bean id="UpdateSessionWithSPSession"
class="net.shibboleth.idp.session.impl.UpdateSessionWithSPSession" scope="prototype"
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-flow.xml
index d38a5145..375728e8 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-flow.xml
@@ -60,6 +60,7 @@
<evaluate expression="PopulateRequestObjectDecryptionParameters" />
<evaluate expression="PopulateRequestObjectSignatureValidationParameters" />
<evaluate expression="DecryptRequestObject" />
+ <evaluate expression="ValidateRequestObjectSignature" />
<evaluate expression="ValidateRequestObject" />
<evaluate expression="ValidateRedirectURI" />
<evaluate expression="ValidateResponseType" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/keyset/keyset-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/keyset/keyset-beans.xml
index f65e20e6..1f3ecc3b 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/keyset/keyset-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/keyset/keyset-beans.xml
@@ -13,6 +13,11 @@
<bean id="shibboleth.oidc.loggingId" class="java.lang.String" c:_0="%{idp.service.logging.oidckeyset:OIDC.Keyset}" />
<bean id="FormOutboundMessage"
- class="net.shibboleth.idp.plugin.oidc.op.profile.impl.FormOutboundKeySetResponseMessage" scope="prototype" />
+ class="net.shibboleth.oidc.profile.impl.FormOutboundKeySetResponseMessage" scope="prototype"
+ p:credentialsToPublishLookupStrategy="#{getObject('shibboleth.oidc.keyset.KeySetCredentialsToPublishLookupStrategy') ?:
+ getObject('shibboleth.oidc.keyset.DefaultKeySetCredentialsToPublishLookupStrategy')}"/>
+
+ <bean id="shibboleth.oidc.keyset.DefaultKeySetCredentialsToPublishLookupStrategy"
+ class="net.shibboleth.oidc.profile.config.navigate.JWKCredentialsToPublishLookupStrategy"/>
</beans>
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
index 82807b17..2756feed 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
@@ -300,14 +300,20 @@
<!-- OIDC response handling for access/refresh tokens. -->
<bean id="PopulateUserInfoAccessTokenSignatureSigningParameters"
- class="net.shibboleth.idp.plugin.oidc.op.profile.impl.PopulateOIDCSignatureSigningParameters"
+ class="net.shibboleth.oidc.profile.impl.PopulateJWTSignatureSigningParameters"
scope="prototype"
- c:strategy-ref="shibboleth.MessageContextLookup.Inbound"
- p:configurationLookupStrategy-ref="shibboleth.SignatureSigningConfigurationLookup"
- p:signatureSigningParametersResolver-ref="shibboleth.oidc.TokenSignatureSigningParametersResolver">
+ c:strategy-ref="shibboleth.MessageContextLookup.Inbound">
+ <property name="configurationLookupStrategy">
+ <bean lazy-init="true"
+ class="net.shibboleth.oidc.profile.config.navigate.JWTSignatureSigningConfigurationLookupFunction"
+ p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
+ </property>
+ <property name="signatureSigningParametersResolver">
+ <bean class="net.shibboleth.oidc.security.impl.BasicJWTSignatureSigningParametersResolver" />
+ </property>
<property name="securityParametersContextLookupStrategy">
<bean parent="shibboleth.Functions.Compose"
- c:g-ref="shibboleth.ChildLookupOrCreate.SecurityParameters"
+ c:g-ref="shibboleth.oidc.ChildLookupOrCreate.JWTSecurityParameters"
c:f-ref="shibboleth.ChildLookup.RelyingParty" />
</property>
</bean>
@@ -316,14 +322,22 @@
class="net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.BuildAccessToken" scope="prototype"
p:dataSealer="#{getObject('%{idp.oidc.tokenSealer:shibboleth.oidc.TokenSealer}'.trim())}" />
- <bean id="SignOIDCAccessToken"
- class="net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.SignAccessToken" scope="prototype"
- p:typeHeader="at+jwt">
- <property name="securityParametersLookupStrategy">
- <bean parent="shibboleth.Functions.Compose"
- c:g-ref="shibboleth.ChildLookup.SecurityParameters"
- c:f-ref="shibboleth.ChildLookup.RelyingParty" />
- </property>
+ <bean id="SignOIDCAccessToken" class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor"
+ scope="prototype" c:executionDirection="OUTBOUND ">
+ <constructor-arg name="messageHandler">
+ <bean id="SignOIDCAccessTokenHandler"
+ class="net.shibboleth.oidc.security.impl.SignJWTHandler" scope="prototype" p:logName="Access Token"
+ p:typeHeader="at+jwt">
+ <property name="claimsToSignLookupStrategy">
+ <bean
+ class="net.shibboleth.idp.plugin.oidc.op.messaging.context.logic.JWTClaimsSetFromJWTAccessTokenLookupFunction" />
+ </property>
+ <property name="jwtUpdateConsumer">
+ <bean
+ class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.JWTAccessTokenUpdateStrategy" />
+ </property>
+ </bean>
+ </constructor-arg>
</bean>
<bean id="SetOAuthAccessTokenToResponseContext"
@@ -355,27 +369,60 @@
<!-- ID token actions. -->
<bean id="PopulateIDTokenSignatureSigningParameters"
- class="net.shibboleth.idp.plugin.oidc.op.profile.impl.PopulateOIDCSignatureSigningParameters"
+ class="net.shibboleth.oidc.profile.impl.PopulateJWTSignatureSigningParameters"
scope="prototype"
- c:strategy-ref="shibboleth.MessageContextLookup.Inbound"
- p:configurationLookupStrategy-ref="shibboleth.SignatureSigningConfigurationLookup"
- p:signatureSigningParametersResolver-ref="shibboleth.oidc.TokenSignatureSigningParametersResolver">
- <property name="securityParametersContextLookupStrategy">
+ c:strategy-ref="shibboleth.MessageContextLookup.Outbound">
+ <property name="configurationLookupStrategy">
+ <bean lazy-init="true"
+ class="net.shibboleth.oidc.profile.config.navigate.JWTSignatureSigningConfigurationLookupFunction"
+ p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
+ </property>
+ <property name="signatureSigningParametersResolver">
+ <bean class="net.shibboleth.oidc.security.impl.BasicJWTSignatureSigningParametersResolver" />
+ </property>
+ <property name="securityParametersContextLookupStrategy">
<bean parent="shibboleth.Functions.Compose"
- c:g-ref="shibboleth.ChildLookupOrCreate.SecurityParameters"
- c:f-ref="shibboleth.ChildLookup.RelyingParty" />
+ c:g-ref="shibboleth.oidc.ChildLookupOrCreate.JWTSecurityParameters"
+ c:f-ref="shibboleth.MessageContextLookup.Outbound" />
</property>
</bean>
<bean id="PopulateIDTokenEncryptionParameters"
- class="net.shibboleth.idp.plugin.oidc.op.profile.impl.PopulateOIDCEncryptionParameters" scope="prototype"
- p:configurationLookupStrategy-ref="shibboleth.EncryptionConfigurationLookup"
- p:encryptionParametersResolver-ref="shibboleth.oidc.EncryptionParametersResolver" />
-
- <bean id="shibboleth.oidc.EncryptionParametersResolver"
- class="net.shibboleth.idp.plugin.oidc.op.security.impl.OIDCClientInformationEncryptionParametersResolver"
- p:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache"
- p:keyFetchInterval="%{idp.oidc.jwksuri.fetchInterval:PT30M}" />
+ class="net.shibboleth.oidc.profile.impl.PopulateJWTEncryptionParameters" scope="prototype"
+ p:forFriendlyName="ID Token">
+ <property name="clientMetadataContextLookupStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultOIDCMetadataContextLookupFunction"
+ p:inbound="true" />
+ </property>
+ <property name="configurationLookupStrategy">
+ <bean lazy-init="true"
+ class="net.shibboleth.oidc.profile.config.navigate.JWTEncryptionConfigurationLookupFunction"
+ p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
+ </property>
+ <property name="encryptionParametersResolver">
+ <bean class="net.shibboleth.oidc.security.impl.DefaultJWTEncryptionParametersResolver">
+ <property name="keyTransportEncryptionAlgorithmsLookupStrategy">
+ <bean
+ class="net.shibboleth.oidc.security.impl.ClientInformationKeyTransportEncryptionAlgorithmsLookupStrategy">
+ <constructor-arg>
+ <bean
+ class="net.shibboleth.oidc.profile.config.navigate.ClientInformationStringValueLookupFunction"
+ c:keyName="id_token_encrypted_response_alg" />
+ </constructor-arg>
+ </bean>
+ </property>
+ <property name="dataEncryptionAlgorithmsLookupStrategy">
+ <bean class="net.shibboleth.oidc.security.impl.ClientInformationDataEncryptionAlgorithmsLookupStrategy">
+ <constructor-arg>
+ <bean
+ class="net.shibboleth.oidc.profile.config.navigate.ClientInformationStringValueLookupFunction"
+ c:keyName="id_token_encrypted_response_enc" />
+ </constructor-arg>
+ </bean>
+ </property>
+ </bean>
+ </property>
+ </bean>
<bean id="AddIDTokenShell"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.AddIDTokenShell" scope="prototype" />
@@ -406,7 +453,7 @@
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.AddAccessTokenHashToIDToken" scope="prototype">
<property name="securityParametersLookupStrategy">
<bean parent="shibboleth.Functions.Compose"
- c:g-ref="shibboleth.ChildLookup.SecurityParameters"
+ c:g-ref="shibboleth.oidc.ChildLookupOrCreate.JWTSecurityParameters"
c:f-ref="shibboleth.ChildLookup.RelyingParty" />
</property>
</bean>
@@ -414,16 +461,40 @@
<bean id="ManipulateClaimsForIDToken"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.ManipulateClaimsForIDToken" scope="prototype" />
- <bean id="SignIDToken" class="net.shibboleth.idp.plugin.oidc.op.profile.impl.SignIDToken" scope="prototype">
- <property name="securityParametersLookupStrategy">
- <bean parent="shibboleth.Functions.Compose"
- c:g-ref="shibboleth.ChildLookup.SecurityParameters"
- c:f-ref="shibboleth.ChildLookup.RelyingParty" />
- </property>
+ <bean id="SignIDToken" class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor"
+ scope="prototype" c:executionDirection="OUTBOUND ">
+ <constructor-arg name="messageHandler">
+ <bean id="SignIDTokenHandler"
+ class="net.shibboleth.oidc.security.impl.SignJWTHandler" scope="prototype" p:logName="ID Token">
+ <property name="claimsToSignLookupStrategy">
+ <bean
+ class="net.shibboleth.idp.plugin.oidc.op.messaging.context.logic.JWTClaimsSetFromIDTokenLookupFunction" />
+ </property>
+ <property name="jwtUpdateConsumer">
+ <bean
+ class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.ProcessedTokenUpdateStrategy" />
+ </property>
+ </bean>
+ </constructor-arg>
</bean>
- <bean id="EncryptIDToken" class="net.shibboleth.idp.plugin.oidc.op.profile.impl.EncryptProcessedToken"
- scope="prototype" />
+ <bean id="EncryptIDToken" class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor"
+ scope="prototype" c:executionDirection="OUTBOUND">
+ <constructor-arg name="messageHandler">
+ <bean id="EncryptIDTokenHandler"
+ class="net.shibboleth.oidc.security.impl.EncryptJWTHandler" scope="prototype"
+ p:logName="ID Token">
+ <property name="payloadToEncryptLookupStrategy">
+ <bean
+ class="net.shibboleth.idp.plugin.oidc.op.messaging.context.logic.PayloadFromProcessedTokenLookupFunction" />
+ </property>
+ <property name="jwtUpdateConsumer">
+ <bean
+ class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.ProcessedTokenUpdateStrategy" />
+ </property>
+ </bean>
+ </constructor-arg>
+ </bean>
<bean id="FormOutboundMessage"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.FormOutboundTokenResponseMessage" scope="prototype" />
@@ -440,24 +511,67 @@
<!-- Third-party token actions. -->
<bean id="PopulateThirdPartyAccessTokenSignatureSigningParameters"
- class="net.shibboleth.idp.plugin.oidc.op.profile.impl.PopulateOIDCSignatureSigningParameters"
+ class="net.shibboleth.oidc.profile.impl.PopulateJWTSignatureSigningParameters"
scope="prototype"
c:strategy-ref="shibboleth.MessageContextLookup.Outbound"
- p:configurationLookupStrategy-ref="shibboleth.SignatureSigningConfigurationLookup"
- p:signatureSigningParametersResolver-ref="shibboleth.oidc.TokenSignatureSigningParametersResolver"
- p:securityParametersContextLookupStrategy-ref="AudienceSecurityParametersCreationStrategy" />
-
+ p:securityParametersContextLookupStrategy-ref="AudienceSecurityParametersCreationStrategy">
+ <property name="configurationLookupStrategy">
+ <bean lazy-init="true"
+ class="net.shibboleth.oidc.profile.config.navigate.JWTSignatureSigningConfigurationLookupFunction"
+ p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
+ </property>
+ <property name="signatureSigningParametersResolver">
+ <bean class="net.shibboleth.oidc.security.impl.BasicJWTSignatureSigningParametersResolver" />
+ </property>
+ </bean>
+
<bean id="AudienceSecurityParametersCreationStrategy" parent="shibboleth.Functions.Compose"
- c:g-ref="shibboleth.ChildLookupOrCreate.SecurityParameters"
+ c:g-ref="shibboleth.oidc.ChildLookupOrCreate.JWTSecurityParameters"
c:f-ref="AudienceRelyingPartyCreationStrategy" />
+
+ <bean id="AudienceSecurityParametersCreationViaMessageContextStrategy" parent="shibboleth.Functions.Compose">
+ <constructor-arg name="g" ref="AudienceSecurityParametersCreationStrategy" />
+ <constructor-arg name="f">
+ <bean parent="shibboleth.Functions.Expression" c:expression="#input.getParent()" />
+ </constructor-arg>
+ </bean>
<bean id="PopulateThirdPartyAccessTokenEncryptionParameters"
- class="net.shibboleth.idp.plugin.oidc.op.profile.impl.PopulateOIDCEncryptionParameters" scope="prototype"
+ class="net.shibboleth.oidc.profile.impl.PopulateJWTEncryptionParameters" scope="prototype"
p:encryptionOptionalPredicate-ref="AudienceEncryptionOptionalPredicate"
- p:oidcMetadataContextLookupStrategy-ref="LookupOutboundOIDCMetadataContext"
- p:configurationLookupStrategy-ref="shibboleth.EncryptionConfigurationLookup"
- p:encryptionParametersResolver-ref="shibboleth.oidc.EncryptionParametersResolver"
- p:encryptionContextLookupStrategy-ref="AudienceEncryptionContextCreationStrategy">
+ p:forFriendlyName="JWT Access Token">
+ <property name="clientMetadataContextLookupStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultOIDCMetadataContextLookupFunction"
+ p:inbound="false" />
+ </property>
+ <property name="configurationLookupStrategy">
+ <bean lazy-init="true"
+ class="net.shibboleth.oidc.profile.config.navigate.JWTEncryptionConfigurationLookupFunction"
+ p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
+ </property>
+ <property name="encryptionParametersResolver">
+ <bean class="net.shibboleth.oidc.security.impl.DefaultJWTEncryptionParametersResolver">
+ <property name="keyTransportEncryptionAlgorithmsLookupStrategy">
+ <bean
+ class="net.shibboleth.oidc.security.impl.ClientInformationKeyTransportEncryptionAlgorithmsLookupStrategy">
+ <constructor-arg>
+ <bean
+ class="net.shibboleth.oidc.profile.config.navigate.ClientInformationStringValueLookupFunction"
+ c:keyName="id_token_encrypted_response_alg"/>
+ </constructor-arg>
+ </bean>
+ </property>
+ <property name="dataEncryptionAlgorithmsLookupStrategy">
+ <bean class="net.shibboleth.oidc.security.impl.ClientInformationDataEncryptionAlgorithmsLookupStrategy">
+ <constructor-arg>
+ <bean
+ class="net.shibboleth.oidc.profile.config.navigate.ClientInformationStringValueLookupFunction"
+ c:keyName="id_token_encrypted_response_enc"/>
+ </constructor-arg>
+ </bean>
+ </property>
+ </bean>
+ </property>
<property name="activationCondition">
<bean parent="shibboleth.Conditions.NOT" c:_0-ref="IssueIDTokenCondition" />
</property>
@@ -496,19 +610,46 @@
class="net.shibboleth.oidc.profile.config.navigate.AccessTokenLifetimeLookupFunction"
p:relyingPartyContextLookupStrategy-ref="AudienceRelyingPartyCreationStrategy" />
- <bean id="SignAccessToken"
- class="net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.SignAccessToken" scope="prototype"
- p:securityParametersLookupStrategy-ref="AudienceSecurityParametersCreationStrategy"
- p:typeHeader="at+jwt" />
+ <bean id="SignAccessToken" class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor"
+ scope="prototype" c:executionDirection="OUTBOUND ">
+ <constructor-arg name="messageHandler">
+ <bean id="SignAccessTokenHandler"
+ class="net.shibboleth.oidc.security.impl.SignJWTHandler" scope="prototype" p:logName="Access Token"
+ p:securityParametersLookupStrategy-ref="AudienceSecurityParametersCreationViaMessageContextStrategy"
+ p:typeHeader="at+jwt">
+ <property name="claimsToSignLookupStrategy">
+ <bean
+ class="net.shibboleth.idp.plugin.oidc.op.messaging.context.logic.JWTClaimsSetFromJWTAccessTokenLookupFunction" />
+ </property>
+ <property name="jwtUpdateConsumer">
+ <bean
+ class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.JWTAccessTokenUpdateStrategy" />
+ </property>
+ </bean>
+ </constructor-arg>
+ </bean>
- <bean id="EncryptAccessToken"
- class="net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.EncryptAccessToken" scope="prototype"
- p:encryptionContextLookupStrategy-ref="AudienceEncryptionContextCreationStrategy">
+ <bean id="EncryptAccessToken" class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor"
+ scope="prototype" c:executionDirection="OUTBOUND">
+ <constructor-arg name="messageHandler">
+ <bean id="EncryptAccessTokenHandler"
+ class="net.shibboleth.oidc.security.impl.EncryptJWTHandler" scope="prototype"
+ p:logName="Access Token">
+ <property name="payloadToEncryptLookupStrategy">
+ <bean
+ class="net.shibboleth.idp.plugin.oidc.op.messaging.context.logic.PayloadFromJWTAccessTokenLookupFunction" />
+ </property>
+ <property name="jwtUpdateConsumer">
+ <bean
+ class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.JWTAccessTokenUpdateStrategy" />
+ </property>
+ </bean>
+ </constructor-arg>
<property name="activationCondition">
<bean parent="shibboleth.Conditions.NOT" c:_0-ref="IssueIDTokenCondition" />
</property>
</bean>
-
+
<bean id="PostResponsePopulateAuditContext" parent="shibboleth.AbstractPopulateAuditContext"
p:fieldExtractors="#{getObject('shibboleth.oidc.TokenPostResponseAuditExtractors') ?: getObject('shibboleth.oidc.DefaultTokenPostResponseAuditExtractors')}" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-beans.xml
index 004af880..f1f39b66 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-beans.xml
@@ -78,35 +78,69 @@
</bean>
<bean id="PopulateUserInfoResponseSignatureSigningParameters"
- class="net.shibboleth.idp.plugin.oidc.op.profile.impl.PopulateOIDCSignatureSigningParameters " scope="prototype"
- c:strategy-ref="shibboleth.MessageContextLookup.Inbound"
- p:configurationLookupStrategy-ref="shibboleth.SignatureSigningConfigurationLookup"
+ class="net.shibboleth.oidc.profile.impl.PopulateJWTSignatureSigningParameters" scope="prototype"
+ c:strategy-ref="shibboleth.MessageContextLookup.Outbound"
+ p:configurationLookupStrategy-ref="JWTSignatureSigningConfigurationLookupFunction"
p:signatureSigningParametersResolver-ref="shibboleth.oidc.UserInfoSignatureSigningParametersResolver">
<property name="securityParametersContextLookupStrategy">
+<!-- <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.oidc.ChildLookupOrCreate.JWTSecurityParameters"
+ c:f-ref="shibboleth.ChildLookup.RelyingParty" />-->
<bean parent="shibboleth.Functions.Compose"
- c:g-ref="shibboleth.ChildLookupOrCreate.SecurityParameters"
- c:f-ref="shibboleth.ChildLookup.RelyingParty" />
+ c:g-ref="shibboleth.oidc.ChildLookupOrCreate.JWTSecurityParameters"
+ c:f-ref="shibboleth.MessageContextLookup.Outbound" />
</property>
<property name="existingParametersContextLookupStrategy">
<bean parent="shibboleth.Functions.Compose"
- c:g-ref="shibboleth.ChildLookup.SecurityParameters"
+ c:g-ref="shibboleth.oidc.ChildLookup.JWTSecurityParameters"
c:f-ref="shibboleth.MessageContextLookup.Outbound" />
</property>
</bean>
+ <bean id="JWTSignatureSigningConfigurationLookupFunction" lazy-init="true"
+ class="net.shibboleth.oidc.profile.config.navigate.JWTSignatureSigningConfigurationLookupFunction"
+ p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
+
+
<bean id="shibboleth.oidc.UserInfoSignatureSigningParametersResolver"
- class="net.shibboleth.idp.plugin.oidc.op.security.impl.OIDCClientInformationSignatureSigningParametersResolver"
- p:parameterType="#{T(net.shibboleth.idp.plugin.oidc.op.security.impl.OIDCClientInformationSignatureSigningParametersResolver.ParameterType).USERINFO_SIGNING}" />
+ class="net.shibboleth.oidc.security.impl.BasicJWTSignatureSigningParametersResolver" />
<bean id="PopulateUserInfoResponseEncryptionParameters"
- class="net.shibboleth.idp.plugin.oidc.op.profile.impl.PopulateOIDCEncryptionParameters" scope="prototype"
- p:configurationLookupStrategy-ref="shibboleth.EncryptionConfigurationLookup"
- p:encryptionParametersResolver-ref="shibboleth.oidc.EncryptionParametersResolver" />
-
- <bean id="shibboleth.oidc.EncryptionParametersResolver"
- class="net.shibboleth.idp.plugin.oidc.op.security.impl.OIDCClientInformationEncryptionParametersResolver"
- p:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache" p:keyFetchInterval="%{idp.oidc.jwksuri.fetchInterval:PT30M}"
- p:parameterType="#{T(net.shibboleth.idp.plugin.oidc.op.security.impl.OIDCClientInformationEncryptionParametersResolver.ParameterType).USERINFO_ENCRYPTION}" />
+ class="net.shibboleth.oidc.profile.impl.PopulateJWTEncryptionParameters" scope="prototype"
+ p:forFriendlyName="UserInfo response">
+ <property name="clientMetadataContextLookupStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultOIDCMetadataContextLookupFunction"
+ p:inbound="true" />
+ </property>
+ <property name="configurationLookupStrategy">
+ <bean lazy-init="true"
+ class="net.shibboleth.oidc.profile.config.navigate.JWTEncryptionConfigurationLookupFunction"
+ p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
+ </property>
+ <property name="encryptionParametersResolver">
+ <bean class="net.shibboleth.oidc.security.impl.DefaultJWTEncryptionParametersResolver">
+ <property name="keyTransportEncryptionAlgorithmsLookupStrategy">
+ <bean
+ class="net.shibboleth.oidc.security.impl.ClientInformationKeyTransportEncryptionAlgorithmsLookupStrategy">
+ <constructor-arg>
+ <bean
+ class="net.shibboleth.oidc.profile.config.navigate.ClientInformationStringValueLookupFunction"
+ c:keyName="userinfo_encrypted_response_alg" />
+ </constructor-arg>
+ </bean>
+ </property>
+ <property name="dataEncryptionAlgorithmsLookupStrategy">
+ <bean class="net.shibboleth.oidc.security.impl.ClientInformationDataEncryptionAlgorithmsLookupStrategy">
+ <constructor-arg>
+ <bean
+ class="net.shibboleth.oidc.profile.config.navigate.ClientInformationStringValueLookupFunction"
+ c:keyName="userinfo_encrypted_response_enc" />
+ </constructor-arg>
+ </bean>
+ </property>
+ </bean>
+ </property>
+ </bean>
<bean id="shibboleth.TokenRequestRequestedClaimsLookupFunction"
class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestRequestedClaimsLookupFunction" />
@@ -133,17 +167,47 @@
<bean id="shibboleth.UserInfoResponseClaimsSetLookupStrategy"
class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.UserInfoResponseClaimsSetLookupFunction" />
- <bean id="SignUserInfoResponse" class="net.shibboleth.idp.plugin.oidc.op.userinfo.profile.impl.SignUserInfoResponse"
- scope="prototype">
- <property name="securityParametersLookupStrategy">
- <bean parent="shibboleth.Functions.Compose"
- c:g-ref="shibboleth.ChildLookup.SecurityParameters"
- c:f-ref="shibboleth.ChildLookup.RelyingParty" />
+ <bean id="SignUserInfoResponse" class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor"
+ scope="prototype" c:executionDirection="OUTBOUND" p:activationCondition-ref="SignUserInfoResponseCondition">
+ <constructor-arg name="messageHandler">
+ <bean id="SignUserInfoResponseHandler"
+ class="net.shibboleth.oidc.security.impl.SignJWTHandler" scope="prototype" p:logName="UserInfo">
+ <property name="claimsToSignLookupStrategy">
+ <bean
+ class="net.shibboleth.idp.plugin.oidc.op.messaging.context.logic.JWTClaimsSetFromUserInfoLookupFunction" />
+ </property>
+ <property name="jwtUpdateConsumer">
+ <bean
+ class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.ProcessedTokenUpdateStrategy" />
+ </property>
+ </bean>
+ </constructor-arg>
+ </bean>
+
+ <bean id ="SignUserInfoResponseCondition" parent="shibboleth.Conditions.Expression"
+ c:_0="#custom.apply(#input) != null">
+ <property name="customObject">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultUserInfoSigningAlgLookupFunction" />
</property>
</bean>
- <bean id="EncryptUserInfoResponse" class="net.shibboleth.idp.plugin.oidc.op.profile.impl.EncryptProcessedToken"
- scope="prototype" />
+ <bean id="EncryptUserInfoResponse" class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor"
+ scope="prototype" c:executionDirection="OUTBOUND">
+ <constructor-arg name="messageHandler">
+ <bean id="EncryptUserInfoHandler"
+ class="net.shibboleth.oidc.security.impl.EncryptJWTHandler" scope="prototype"
+ p:logName="UserInfo">
+ <property name="payloadToEncryptLookupStrategy">
+ <bean
+ class="net.shibboleth.idp.plugin.oidc.op.messaging.context.logic.PayloadFromUserInfoLookupFunction" />
+ </property>
+ <property name="jwtUpdateConsumer">
+ <bean
+ class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.ProcessedTokenUpdateStrategy" />
+ </property>
+ </bean>
+ </constructor-arg>
+ </bean>
<bean id="FormOutboundMessage"
class="net.shibboleth.idp.plugin.oidc.op.userinfo.profile.impl.FormOutboundUserInfoResponseMessage" scope="prototype" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index 85fbc41e..f14604fc 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -11,6 +11,30 @@
default-init-method="initialize" default-destroy-method="destroy">
+ <!--
+ Security Configuration Defaults. These settings establish the default security configurations for
+ signatures and loads the default credentials used.
+ -->
+ <bean id="shibboleth.oidc.BasicSignatureValidationConfiguration" abstract="true"
+ class="net.shibboleth.oidc.security.impl.BasicJWTSignatureValidationConfiguration"
+ p:includedAlgorithms="#{getObject('shibboleth.oidc.IncludedSignatureAlgorithms')}"
+ p:excludedAlgorithms="#{getObject('shibboleth.oidc.ExcludedSignatureAlgorithms')}" />
+
+ <bean id="shibboleth.oidc.BasicSignatureSigningConfiguration" abstract="true"
+ class="net.shibboleth.oidc.security.impl.BasicJWTSignatureSigningConfiguration"
+ p:includedAlgorithms="#{getObject('shibboleth.oidc.IncludedSignatureAlgorithms')}"
+ p:excludedAlgorithms="#{getObject('shibboleth.oidc.ExcludedSignatureAlgorithms')}" />
+
+ <bean id="shibboleth.oidc.BasicEncryptionConfiguration" abstract="true"
+ class="net.shibboleth.oidc.security.impl.BasicJWTEncryptionConfiguration"
+ p:includedAlgorithms="#{getObject('shibboleth.oidc.IncludedEncryptionAlgorithms')}"
+ p:excludedAlgorithms="#{getObject('shibboleth.oidc.ExcludedEncryptionAlgorithms')}" />
+
+ <bean id="shibboleth.oidc.BasicDecryptionConfiguration" abstract="true"
+ class="net.shibboleth.oidc.security.impl.BasicJWTDecryptionConfiguration"
+ p:includedAlgorithms="#{getObject('shibboleth.oidc.IncludedEncryptionAlgorithms')}"
+ p:excludedAlgorithms="#{getObject('shibboleth.oidc.ExcludedEncryptionAlgorithms')}" />
+
<!-- OIDC Profile Configurations. -->
<bean id="AbstractOIDCProfile" abstract="true"
@@ -687,25 +711,22 @@
<bean id="shibboleth.oidc.DefaultSecurityConfiguration"
class="net.shibboleth.oidc.profile.config.OIDCSecurityConfiguration">
- <property name="signatureSigningConfiguration">
+ <property name="jwtSignatureSigningConfiguration">
<ref bean="#{'%{idp.oidc.signing.config:shibboleth.oidc.SigningConfiguration}'.trim()}" />
</property>
- <property name="encryptionConfiguration">
+ <property name="jwtEncryptionConfiguration">
<ref bean="#{'%{idp.oidc.encryption.config:shibboleth.oidc.EncryptionConfiguration}'.trim()}" />
</property>
- <property name="requestObjectDecryptionConfiguration">
- <ref bean="#{'%{idp.oidc.rodecrypt.config:shibboleth.oidc.requestObjectDecryptionConfiguration}'.trim()}" />
- </property>
- <property name="requestObjectSignatureValidationConfiguration">
- <ref bean="#{'%{idp.oidc.rovalid.config:shibboleth.oidc.requestObjectSignatureValidationConfiguration}'.trim()}" />
+ <property name="jwtDecryptionConfiguration">
+ <ref bean="#{'%{idp.oidc.rodecrypt.config:shibboleth.oidc.DecryptionConfiguration}'.trim()}" />
</property>
- <property name="tokenEndpointJwtSignatureValidationConfiguration">
- <ref bean="#{'%{idp.oidc.tevalid.config:shibboleth.oidc.tokenEndpointJwtSignatureValidationConfiguration}'.trim()}" />
+ <property name="jwtSignatureValidationConfiguration">
+ <ref bean="#{'%{idp.oidc.rovalid.config:shibboleth.oidc.SignatureValidationConfiguration}'.trim()}" />
</property>
</bean>
<!-- Configuration for credentials and supported algorithms for ID Token and UserInfo response signing. -->
- <bean id="shibboleth.oidc.SigningConfiguration" parent="shibboleth.BasicSignatureSigningConfiguration"
+ <bean id="shibboleth.oidc.SigningConfiguration" parent="shibboleth.oidc.BasicSignatureSigningConfiguration"
p:signingCredentials="#{getObject('shibboleth.oidc.SigningCredentials')}">
<property name="signatureAlgorithms">
<list>
@@ -738,7 +759,9 @@
</bean>
<!-- Configuration for supported algorithms for ID Token and UserInfo response encryption. -->
- <bean id="shibboleth.oidc.EncryptionConfiguration" parent="shibboleth.BasicEncryptionConfiguration">
+ <bean id="shibboleth.oidc.EncryptionConfiguration" parent="shibboleth.oidc.BasicEncryptionConfiguration"
+ p:KEKCredentialResolver-ref="defaultOIDCKeyEncryptionCredentialResolver"
+ p:contentEncryptionKeyCredentialResolver-ref="defaultOIDCContentEncryptionKeyCredentialResolver">
<property name="keyTransportEncryptionAlgorithms">
<list>
<util:constant
@@ -778,52 +801,85 @@
</list>
</property>
</bean>
-
+
+ <bean id="defaultOIDCKeyEncryptionCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
+ <constructor-arg>
+ <list>
+ <bean id="ClientInformationCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ClientInformationCredentialResolver"
+ p:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache"
+ p:keyFetchInterval="%{idp.oidc.provider.keyfetch.interval:PT30M}"/>
+<!-- <bean id="CriterionCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.CriterionCredentialResolver" />-->
+ </list>
+ </constructor-arg>
+ </bean>
+
+ <!--
+ A resolver to resolve pre-shared Direct Encryption or Key Wrapping credentials based on the
+ client_secret in the input criterion. Returns the raw value, even though the key to use
+ is a derivative of this key.
+ -->
+ <bean id="defaultOIDCContentEncryptionKeyCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
+ <constructor-arg>
+ <list>
+ <bean id="ClientInformationCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ClientInformationCredentialResolver"
+ p:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache"
+ p:keyFetchInterval="%{idp.oidc.provider.keyfetch.interval:PT30M}"/>
+<!-- <bean id="CriterionCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.CriterionCredentialResolver" />-->
+ </list>
+ </constructor-arg>
+ </bean>
+
<!-- Configuration for credentials and supported algorithms for request object decryption. -->
- <bean id="shibboleth.oidc.requestObjectDecryptionConfiguration" parent="shibboleth.BasicEncryptionConfiguration"
- p:keyTransportEncryptionCredentials="#{getObject('shibboleth.oidc.EncryptionCredentials')}">
- <property name="keyTransportEncryptionAlgorithms">
+ <bean id="shibboleth.oidc.DecryptionConfiguration"
+ parent="shibboleth.oidc.BasicDecryptionConfiguration"
+ p:KEKCredentialResolver-ref="defaultOIDCKeyDecryptionCredentialResolver"
+ p:contentEncryptionKeyCredentialResolver-ref="defaultOIDCContentDecryptionKeyCredentialResolver">
+ </bean>
+
+ <!--
+ A resolver to resolve a pre-shared Direct Encryption key e.g. a pairwise client_secret from the input criterion
+ from which to derive the decryption key.
+ -->
+ <bean id="defaultOIDCContentDecryptionKeyCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
+ <constructor-arg>
<list>
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_RSA_1_5" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_RSA_OAEP" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_RSA_OAEP_256" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_128_KW" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_192_KW" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_256_KW" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_128_GCM_KW" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_192_GCM_KW" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_256_GCM_KW" />
+ <bean id="CriterionCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.CriterionCredentialResolver" />
</list>
- </property>
- <property name="dataEncryptionAlgorithms">
+ </constructor-arg>
+ </bean>
+
+ <!--
+ A resolver to public/private key encryption keys global to the RP
+ -->
+ <bean id="defaultOIDCKeyDecryptionCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
+ <constructor-arg>
<list>
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A128CBC_HS256" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A192CBC_HS384" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A256CBC_HS512" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A128GCM" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A192GCM" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A256GCM" />
+ <bean class="net.shibboleth.oidc.security.credential.impl.LocalJOSEObjectCredentialResolver">
+ <constructor-arg name="localCredentialResolver">
+ <bean
+ class="net.shibboleth.oidc.security.credential.impl.CollectionJOSEObjectCredentialResolver"
+ c:credentials-ref="shibboleth.oidc.EncryptionCredentials" />
+ </constructor-arg>
+ </bean>
+ <bean id="CriterionCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.CriterionCredentialResolver" />
</list>
- </property>
+ </constructor-arg>
</bean>
-
+
<!-- Configuration for supported algorithms for request object signature validation. -->
- <bean id="shibboleth.oidc.requestObjectSignatureValidationConfiguration" parent="shibboleth.BasicSignatureSigningConfiguration">
+ <bean id="shibboleth.oidc.SignatureValidationConfiguration" parent="shibboleth.oidc.BasicSignatureValidationConfiguration"
+ p:signatureTrustEngine-ref="ExplicitKeySignedJWTTrustEngine">
+<!--
<property name="signatureAlgorithms">
<list>
<util:constant
@@ -846,53 +902,57 @@
static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_HS_512" />
</list>
</property>
+-->
</bean>
- <!-- Configuration for supported algorithms for token endpoint authentication JWT signature validation. -->
- <bean id="shibboleth.oidc.tokenEndpointJwtSignatureValidationConfiguration" parent="shibboleth.BasicSignatureSigningConfiguration">
- <property name="signatureAlgorithms">
+ <!-- A resolver for resolving trusted credentials to match against those resolved from the JWT -->
+ <bean id="defaultSignedJWTTrustedCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
+ <constructor-arg>
<list>
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_RS_256" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_RS_384" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_RS_512" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_ES_256" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_ES_384" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_ES_512" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_HS_256" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_HS_384" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_HS_512" />
+ <bean id="ClientInformationCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ClientInformationCredentialResolver"
+ p:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache"
+ p:keyFetchInterval="%{idp.oidc.provider.keyfetch.interval:PT30M}"/>
+ <bean id="CriterionCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.CriterionCredentialResolver" />
</list>
- </property>
+ </constructor-arg>
</bean>
+
+ <!-- A resolver for resolving 'untrusted' credentials out of the JOSE header of JWTs -->
+ <bean id="defaultSignedJWTJOSEHeaderCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver" />
+
+ <bean id="ExplicitKeySignedJWTTrustEngine"
+ class="net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine"
+ c:resolver-ref="defaultSignedJWTTrustedCredentialResolver"
+ c:JOSEObjectResolver-ref="defaultSignedJWTJOSEHeaderCredentialResolver" />
+
<!-- Configuration for publishing key set. -->
<bean id="shibboleth.oidc.PublishKeySetSecurityConfiguration"
class="net.shibboleth.oidc.profile.config.OIDCSecurityConfiguration">
- <property name="signatureSigningConfiguration">
+ <property name="jwtSignatureSigningConfiguration">
<ref bean="shibboleth.oidc.PublishKeySetSigningConfiguration" />
</property>
- <property name="requestObjectDecryptionConfiguration">
- <ref bean="shibboleth.oidc.PublishKeySetRequestObjectDecryptionConfiguration" />
+ <property name="jwtDecryptionConfiguration">
+ <ref bean="shibboleth.oidc.PublishKeySetDecryptionConfiguration" />
</property>
</bean>
-
+
<!-- Signing keys to publish. -->
- <bean id="shibboleth.oidc.PublishKeySetSigningConfiguration" parent="shibboleth.BasicSignatureSigningConfiguration"
+ <bean id="shibboleth.oidc.PublishKeySetSigningConfiguration" parent="shibboleth.oidc.BasicSignatureSigningConfiguration"
p:signingCredentials="#{getObject('shibboleth.oidc.SigningCredentialsToPublish') ?: getObject('shibboleth.oidc.SigningCredentials')}"/>
-
- <!-- Encryption keys to publish. -->
- <bean id="shibboleth.oidc.PublishKeySetRequestObjectDecryptionConfiguration" parent="shibboleth.BasicEncryptionConfiguration"
- p:keyTransportEncryptionCredentials="#{getObject('shibboleth.oidc.EncryptionCredentialsToPublish') ?: getObject('shibboleth.oidc.EncryptionCredentials')}"/>
+ <!-- Encryption keys to publish. -->
+ <bean id="shibboleth.oidc.PublishKeySetDecryptionConfiguration" parent="shibboleth.oidc.BasicDecryptionConfiguration">
+ <property name="KEKCredentialResolver">
+ <bean class="net.shibboleth.oidc.security.credential.impl.ReturnAllCollectionJOSEObjectCredentialResolver"
+ c:credentials="#{getObject('shibboleth.oidc.EncryptionCredentialsToPublish') ?: getObject('shibboleth.oidc.EncryptionCredentials')}"/>
+ </property>
+ </bean>
+
<bean id="shibboleth.oidc.dyngreg.DefaultMetadataPolicyFilename" class="java.lang.String" factory-method="valueOf">
<constructor-arg value="%{idp.oidc.dynreg.defaultMetadataPolicyFile:}" />
</bean>
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/authn/impl/JWTCredentialValidatorTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/authn/impl/JWTCredentialValidatorTest.java
index 621909ec..d3d898b4 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/authn/impl/JWTCredentialValidatorTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/authn/impl/JWTCredentialValidatorTest.java
@@ -29,13 +29,11 @@ import java.util.Collections;
import java.util.Date;
import java.util.List;
-import javax.crypto.spec.SecretKeySpec;
import javax.servlet.http.HttpServletRequest;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.storage.ReplayCache;
import org.opensaml.storage.impl.MemoryStorageService;
-import org.opensaml.xmlsec.context.SecurityParametersContext;
import org.springframework.webflow.execution.Event;
import org.testng.Assert;
import org.testng.annotations.BeforeClass;
@@ -47,7 +45,6 @@ import com.nimbusds.jose.JWSAlgorithm;
import com.nimbusds.jose.JWSHeader;
import com.nimbusds.jose.crypto.MACSigner;
import com.nimbusds.jose.crypto.RSASSASigner;
-import com.nimbusds.jose.jwk.RSAKey;
import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.jwt.SignedJWT;
import com.nimbusds.oauth2.sdk.AuthorizationCode;
@@ -76,8 +73,7 @@ import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
import net.shibboleth.oidc.profile.oauth2.config.AbstractOAuth2ClientAuthenticableProfileConfiguration;
import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenConfiguration;
-import net.shibboleth.oidc.security.credential.BasicJWKCredential;
-import net.shibboleth.oidc.security.impl.OIDCSignatureValidationParameters;
+import net.shibboleth.oidc.security.context.JWTSecurityParametersContext;
import net.shibboleth.oidc.security.jwt.claims.impl.AudienceClaimsValidator;
import net.shibboleth.oidc.security.jwt.claims.impl.ChainingJWTClaimsValidator;
import net.shibboleth.oidc.security.jwt.claims.impl.ExactMatchClaimsValidator;
@@ -140,7 +136,7 @@ public class JWTCredentialValidatorTest extends BaseAuthenticationContextTest {
validator = new JWTCredentialValidator();
validator.setId("test");
- validator.setSecurityParametersLookupStrategy(new ChildContextLookup<>(SecurityParametersContext.class));
+ validator.setSecurityParametersLookupStrategy(new ChildContextLookup<>(JWTSecurityParametersContext.class));
validator.initialize();
action = new ValidateCredentials();
@@ -155,40 +151,6 @@ public class JWTCredentialValidatorTest extends BaseAuthenticationContextTest {
final OIDCClientMetadata metadata = new OIDCClientMetadata();
metadata.setTokenEndpointAuthMethod(storedMethod);
- BasicJWKCredential credential = null;
- final OIDCSignatureValidationParameters params = new OIDCSignatureValidationParameters();
- if (storedMethod.equals(ClientAuthenticationMethod.PRIVATE_KEY_JWT)) {
- params.setSignatureAlgorithm("RS256");
- credential = new BasicJWKCredential();
- credential.setAlgorithm(JWSAlgorithm.parse("RS256"));
- final RSAKey rsaKey;
- if (sameSecret) {
- rsaKey = new RSAKey.Builder(rsaPublicKey).build();
- } else {
- final KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
- keyGen.initialize(1024);
- rsaKey = new RSAKey.Builder((RSAPublicKey)keyGen.genKeyPair().getPublic()).build();
- }
- credential.setPublicKey(rsaKey.toPublicKey());
- } else if (storedMethod.equals(ClientAuthenticationMethod.CLIENT_SECRET_JWT)) {
- params.setSignatureAlgorithm("HS256");
- credential = new BasicJWKCredential();
- credential.setAlgorithm(JWSAlgorithm.parse("HS256"));
- if (sameSecret) {
- credential.setSecretKey(new SecretKeySpec(clientSecret.getValueBytes(), "NONE"));
- } else {
- credential.setSecretKey(
- new SecretKeySpec("secret1234567890secret1234567890secretWRONG".getBytes(), "NONE"));
- }
- }
-
- if (credential != null) {
- final SecurityParametersContext secCtx =
- (SecurityParametersContext) prc.addSubcontext(new SecurityParametersContext());
- params.getValidationCredentials().add(credential);
- secCtx.setSignatureSigningParameters(params);
- }
-
final OIDCClientInformation clientInformation =
new OIDCClientInformation(clientId, new Date(), metadata, clientSecret);
oidcContext.setClientInformation(clientInformation);
@@ -348,12 +310,6 @@ public class JWTCredentialValidatorTest extends BaseAuthenticationContextTest {
.next().getName(), clientId.getValue());
}
- @Test
- public void testInvalidSecretJwt_signature() throws Exception {
- testFailingJwtAuth(ClientAuthenticationMethod.CLIENT_SECRET_JWT,
- createSecretJWT(validClaimsSet()), false, false);
- }
-
@Test
public void testInvalidSecretJwt_iatInTheFuture() throws Exception {
testFailingJwtAuth(ClientAuthenticationMethod.CLIENT_SECRET_JWT,
@@ -378,12 +334,6 @@ public class JWTCredentialValidatorTest extends BaseAuthenticationContextTest {
createSecretJWT(validClaimsSet()), true, true);
}
- @Test
- public void testInvalidPrivateKeyJwt_signature() throws Exception {
- testFailingJwtAuth(ClientAuthenticationMethod.PRIVATE_KEY_JWT,
- createPrivateKeyJWT(validClaimsSet()), false, false);
- }
-
@Test
public void testInvalidPrivateKeyJwt_iatInTheFuture() throws Exception {
testFailingJwtAuth(ClientAuthenticationMethod.PRIVATE_KEY_JWT,
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateRequestObjectTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateRequestObjectTest.java
index 9c3bd924..6fec7652 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateRequestObjectTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateRequestObjectTest.java
@@ -23,8 +23,6 @@ import net.shibboleth.idp.profile.testing.ActionTestingSupport;
import net.shibboleth.idp.profile.testing.RequestContextBuilder;
import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
import net.shibboleth.oidc.profile.core.OidcEventIds;
-import net.shibboleth.oidc.security.credential.BasicJWKCredential;
-import net.shibboleth.oidc.security.impl.OIDCSignatureValidationParameters;
import net.shibboleth.oidc.security.jwt.claims.impl.AudienceClaimsValidator;
import net.shibboleth.oidc.security.jwt.claims.impl.ChainingJWTClaimsValidator;
import net.shibboleth.oidc.security.jwt.claims.impl.ExactMatchClaimsValidator;
@@ -43,9 +41,7 @@ import java.time.Instant;
import java.util.Date;
import java.util.List;
-import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.xmlsec.context.SecurityParametersContext;
import org.springframework.webflow.execution.Event;
import org.springframework.webflow.execution.RequestContext;
import org.testng.annotations.BeforeMethod;
@@ -100,23 +96,6 @@ public class ValidateRequestObjectTest {
OIDCClientInformation information = new OIDCClientInformation(new ClientID("test"), null, metaData,
new Secret("ultimatetopsecretultimatetopsecret"), null, null);
oidcCtx.setClientInformation(information);
- SecurityParametersContext secCtx =
- (SecurityParametersContext) prc.addSubcontext(new SecurityParametersContext());
- OIDCSignatureValidationParameters params = new OIDCSignatureValidationParameters();
- KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA");
- kpg.initialize(2048);
- kp = kpg.generateKeyPair();
- BasicJWKCredential credentialRSA = new BasicJWKCredential();
- credentialRSA.setAlgorithm(JWSAlgorithm.parse("RS256"));
- credentialRSA.setPublicKey(kp.getPublic());
- params.getValidationCredentials().add(credentialRSA);
- kp = kpg.generateKeyPair();
- BasicJWKCredential credentialRSA2 = new BasicJWKCredential();
- credentialRSA2.setAlgorithm(JWSAlgorithm.parse("RS256"));
- credentialRSA2.setPublicKey(kp.getPublic());
- params.getValidationCredentials().add(credentialRSA2);
- params.setSignatureAlgorithm("RS256");
- secCtx.setSignatureSigningParameters(params);
action = new ValidateRequestObject();
action.setPlainClaimsValidator(buildPlainClaimsValidation());
action.setSignedClaimsValidator(buildSignedClaimsValidation("000123"));
@@ -394,67 +373,6 @@ public class ValidateRequestObjectTest {
ActionTestingSupport.assertEvent(event, OidcEventIds.INVALID_REQUEST_OBJECT);
}
- /**
- * Test signed request object but no sec params context.
- */
- @Test
- public void testRequestObjectSignedWithRS256NoSecParamsCtxt() throws NoSuchAlgorithmException,
- ComponentInitializationException, URISyntaxException, JOSEException, InvalidAlgorithmParameterException {
- prc.removeSubcontext(SecurityParametersContext.class);
- JWSSigner signer = new RSASSASigner(kp.getPrivate());
- JWTClaimsSet ro = new JWTClaimsSet.Builder().subject("alice").build();
- SignedJWT signed = new SignedJWT(new JWSHeader(JWSAlgorithm.RS256), ro);
- signed.sign(signer);
- AuthenticationRequest req =
- new AuthenticationRequest.Builder(new ResponseType("code"), new Scope("openid"), new ClientID("000123"),
- URI.create("https://example.com/callback")).requestObject(signed).state(new State()).build();
- prc.getInboundMessageContext().setMessage(req);
- oidcRespCtx.setRequestObject(req.getRequestObject());
- final Event event = action.execute(requestCtx);
- ActionTestingSupport.assertEvent(event, EventIds.INVALID_SEC_CFG);
- }
-
- /**
- * Test signed request object but no sec params.
- */
- @Test
- public void testRequestObjectSignedWithRS256NoSecParams() throws NoSuchAlgorithmException,
- ComponentInitializationException, URISyntaxException, JOSEException, InvalidAlgorithmParameterException {
- prc.getSubcontext(SecurityParametersContext.class).setSignatureSigningParameters(null);
- JWSSigner signer = new RSASSASigner(kp.getPrivate());
- JWTClaimsSet ro = new JWTClaimsSet.Builder().subject("alice").build();
- SignedJWT signed = new SignedJWT(new JWSHeader(JWSAlgorithm.RS256), ro);
- signed.sign(signer);
- AuthenticationRequest req =
- new AuthenticationRequest.Builder(new ResponseType("code"), new Scope("openid"), new ClientID("000123"),
- URI.create("https://example.com/callback")).requestObject(signed).state(new State()).build();
- prc.getInboundMessageContext().setMessage(req);
- oidcRespCtx.setRequestObject(req.getRequestObject());
- final Event event = action.execute(requestCtx);
- ActionTestingSupport.assertEvent(event, EventIds.INVALID_SEC_CFG);
- }
-
- /**
- * Test signed request object but no credentials is sec params.
- */
- @Test
- public void testRequestObjectSignedWithRS256NoCredsInSecParams() throws NoSuchAlgorithmException,
- ComponentInitializationException, URISyntaxException, JOSEException, InvalidAlgorithmParameterException {
- ((OIDCSignatureValidationParameters) (prc.getSubcontext(SecurityParametersContext.class)
- .getSignatureSigningParameters())).getValidationCredentials().clear();
- JWSSigner signer = new RSASSASigner(kp.getPrivate());
- JWTClaimsSet ro = new JWTClaimsSet.Builder().subject("alice").build();
- SignedJWT signed = new SignedJWT(new JWSHeader(JWSAlgorithm.RS256), ro);
- signed.sign(signer);
- AuthenticationRequest req =
- new AuthenticationRequest.Builder(new ResponseType("code"), new Scope("openid"), new ClientID("000123"),
- URI.create("https://example.com/callback")).requestObject(signed).state(new State()).build();
- prc.getInboundMessageContext().setMessage(req);
- oidcRespCtx.setRequestObject(req.getRequestObject());
- final Event event = action.execute(requestCtx);
- ActionTestingSupport.assertEvent(event, EventIds.INVALID_SEC_CFG);
- }
-
@Test
public void testSignedExpiredRequestObject() throws NoSuchAlgorithmException, ComponentInitializationException,
URISyntaxException, JOSEException, InvalidAlgorithmParameterException {
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AuthorizeFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AuthorizeFlowTest.java
index ed53235b..392f3de1 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AuthorizeFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AuthorizeFlowTest.java
@@ -1247,6 +1247,16 @@ public class AuthorizeFlowTest extends AbstractOidcFlowTest {
assertRequestObjectError(createSecretJWT(ro, clientSecret));
}
+ @Test
+ public void testWithSignedReqObjectWrongSecret() throws IOException, SessionException,
+ JOSEException {
+ final JWTClaimsSet ro = new JWTClaimsSet.Builder()
+ .audience(issuer)
+ .issuer(clientId)
+ .build();
+ assertRequestObjectError(createSecretJWT(ro, clientSecret + "wrong"));
+ }
+
@Test
public void testWithSignedReqObjectOverwriteRedirectUri() throws IOException, ParseException,
SessionException, JOSEException {
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAccessTokenHashToIDTokenTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAccessTokenHashToIDTokenTest.java
index 496b5788..8003a12f 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAccessTokenHashToIDTokenTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAccessTokenHashToIDTokenTest.java
@@ -22,12 +22,12 @@ import java.time.Duration;
import java.time.Instant;
import net.shibboleth.idp.profile.testing.ActionTestingSupport;
+import net.shibboleth.oidc.security.JWTSignatureSigningParameters;
+import net.shibboleth.oidc.security.context.JWTSecurityParametersContext;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import org.opensaml.profile.action.EventIds;
import org.opensaml.security.credential.Credential;
-import org.opensaml.xmlsec.SignatureSigningParameters;
-import org.opensaml.xmlsec.context.SecurityParametersContext;
import org.springframework.webflow.execution.Event;
import org.testng.Assert;
import org.testng.annotations.Test;
@@ -39,15 +39,15 @@ public class AddAccessTokenHashToIDTokenTest extends BaseOIDCResponseActionTest
private AddAccessTokenHashToIDToken action;
- SecurityParametersContext spCtx;
+ JWTSecurityParametersContext spCtx;
private void init(String algo, Credential credential) throws ComponentInitializationException, URISyntaxException {
- spCtx = new SecurityParametersContext();
- final SignatureSigningParameters params = new SignatureSigningParameters();
+ spCtx = new JWTSecurityParametersContext();
+ final JWTSignatureSigningParameters params = new JWTSignatureSigningParameters();
spCtx.setSignatureSigningParameters(params);
params.setSigningCredential(credential);
params.setSignatureAlgorithm(algo);
- profileRequestCtx.addSubcontext(spCtx);
+ profileRequestCtx.getOutboundMessageContext().addSubcontext(spCtx);
setIdTokenToResponseContext("iss", "sub", "aud", Instant.now(), Instant.now());
respCtx.setAccessToken("accesstoken", Duration.ofSeconds(100));
action = new AddAccessTokenHashToIDToken();
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAuthorizationCodeHashToIDTokenTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAuthorizationCodeHashToIDTokenTest.java
index ca2b85ec..c50dac00 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAuthorizationCodeHashToIDTokenTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAuthorizationCodeHashToIDTokenTest.java
@@ -23,12 +23,12 @@ import java.time.Instant;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultComputeAuthorizationCodeHashFunction;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.ResponseContextAuthorizationCodeLookupFunction;
import net.shibboleth.idp.profile.testing.ActionTestingSupport;
+import net.shibboleth.oidc.security.JWTSignatureSigningParameters;
+import net.shibboleth.oidc.security.context.JWTSecurityParametersContext;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import org.opensaml.profile.action.EventIds;
import org.opensaml.security.credential.Credential;
-import org.opensaml.xmlsec.SignatureSigningParameters;
-import org.opensaml.xmlsec.context.SecurityParametersContext;
import org.springframework.webflow.execution.Event;
import org.testng.Assert;
import org.testng.annotations.Test;
@@ -40,16 +40,16 @@ public class AddAuthorizationCodeHashToIDTokenTest extends BaseOIDCResponseActio
private AddAuthorizationCodeHashToIDToken action;
- SecurityParametersContext spCtx;
+ JWTSecurityParametersContext spCtx;
private void init(final String algo, final Credential credential)
throws ComponentInitializationException, URISyntaxException {
- spCtx = new SecurityParametersContext();
- final SignatureSigningParameters params = new SignatureSigningParameters();
+ spCtx = new JWTSecurityParametersContext();
+ final JWTSignatureSigningParameters params = new JWTSignatureSigningParameters();
spCtx.setSignatureSigningParameters(params);
params.setSigningCredential(credential);
params.setSignatureAlgorithm(algo);
- profileRequestCtx.addSubcontext(spCtx);
+ profileRequestCtx.getOutboundMessageContext().addSubcontext(spCtx);
setIdTokenToResponseContext("iss", "sub", "aud", Instant.now(), Instant.now());
respCtx.setAuthorizationCode("authcode");
final DefaultComputeAuthorizationCodeHashFunction hashFunction =
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddSecurityConfigurationToClientMetadataTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddSecurityConfigurationToClientMetadataTest.java
index 621b5067..c8500ecf 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddSecurityConfigurationToClientMetadataTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddSecurityConfigurationToClientMetadataTest.java
@@ -23,8 +23,6 @@ import java.util.List;
import org.mockito.Mockito;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.xmlsec.EncryptionConfiguration;
-import org.opensaml.xmlsec.SignatureSigningConfiguration;
import org.testng.Assert;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
@@ -35,12 +33,14 @@ import com.nimbusds.jose.JWSAlgorithm;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
import net.shibboleth.idp.profile.config.ProfileConfiguration;
-import net.shibboleth.idp.profile.config.SecurityConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.testing.ActionTestingSupport;
import net.shibboleth.oidc.jwa.support.EncryptionConstants;
import net.shibboleth.oidc.jwa.support.KeyManagementConstants;
import net.shibboleth.oidc.jwa.support.SignatureConstants;
+import net.shibboleth.oidc.profile.config.OIDCSecurityConfiguration;
+import net.shibboleth.oidc.security.JWTEncryptionConfiguration;
+import net.shibboleth.oidc.security.JWTSignatureSigningConfiguration;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
/**
@@ -65,14 +65,14 @@ public class AddSecurityConfigurationToClientMetadataTest extends BaseOIDCClient
final List<String> encyrptionAlgs, final List<String> encryptionEncs) {
final RelyingPartyContext rpCtx = profileRequestCtx.getSubcontext(RelyingPartyContext.class);
final ProfileConfiguration profileConfig = Mockito.mock(ProfileConfiguration.class);
- final SecurityConfiguration secConfig = Mockito.mock(SecurityConfiguration.class);
- final SignatureSigningConfiguration signingConfig = Mockito.mock(SignatureSigningConfiguration.class);
+ final OIDCSecurityConfiguration secConfig = Mockito.mock(OIDCSecurityConfiguration.class);
+ final JWTSignatureSigningConfiguration signingConfig = Mockito.mock(JWTSignatureSigningConfiguration.class);
Mockito.when(signingConfig.getSignatureAlgorithms()).thenReturn(signingAlgs);
- Mockito.when(secConfig.getSignatureSigningConfiguration()).thenReturn(signingConfig);
- final EncryptionConfiguration encryptionConfig = Mockito.mock(EncryptionConfiguration.class);
+ Mockito.when(secConfig.getJwtSignatureSigningConfiguration()).thenReturn(signingConfig);
+ final JWTEncryptionConfiguration encryptionConfig = Mockito.mock(JWTEncryptionConfiguration.class);
Mockito.when(encryptionConfig.getDataEncryptionAlgorithms()).thenReturn(encryptionEncs);
Mockito.when(encryptionConfig.getKeyTransportEncryptionAlgorithms()).thenReturn(encyrptionAlgs);
- Mockito.when(secConfig.getEncryptionConfiguration()).thenReturn(encryptionConfig);
+ Mockito.when(secConfig.getJwtEncryptionConfiguration()).thenReturn(encryptionConfig);
Mockito.when(profileConfig.getSecurityConfiguration(profileRequestCtx)).thenReturn(secConfig);
rpCtx.setProfileConfig(profileConfig);
}
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/EncryptProcessedTokenTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/EncryptProcessedTokenTest.java
deleted file mode 100644
index ff05e28a..00000000
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/EncryptProcessedTokenTest.java
+++ /dev/null
@@ -1,222 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.profile.impl;
-
-import net.minidev.json.JSONObject;
-import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
-import net.shibboleth.idp.profile.testing.ActionTestingSupport;
-import net.shibboleth.idp.profile.testing.RequestContextBuilder;
-import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
-import net.shibboleth.oidc.security.credential.BasicJWKCredential;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-import net.shibboleth.utilities.java.support.component.UnmodifiableComponentException;
-import net.shibboleth.utilities.java.support.logic.ConstraintViolationException;
-
-import java.net.URI;
-import java.security.KeyPair;
-import java.security.KeyPairGenerator;
-import java.security.NoSuchAlgorithmException;
-import java.text.ParseException;
-
-import org.opensaml.messaging.context.BaseContext;
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.saml.saml2.profile.context.EncryptionContext;
-import org.opensaml.xmlsec.EncryptionParameters;
-import org.springframework.webflow.execution.Event;
-import org.springframework.webflow.execution.RequestContext;
-import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Test;
-
-import com.nimbusds.jose.JOSEException;
-import com.nimbusds.jose.JWSAlgorithm;
-import com.nimbusds.jose.JWSHeader;
-import com.nimbusds.jose.JWSSigner;
-import com.nimbusds.jose.crypto.RSASSASigner;
-import com.nimbusds.jwt.EncryptedJWT;
-import com.nimbusds.jwt.JWTClaimsSet;
-import com.nimbusds.jwt.SignedJWT;
-import com.nimbusds.oauth2.sdk.ResponseType;
-import com.nimbusds.oauth2.sdk.Scope;
-import com.nimbusds.oauth2.sdk.auth.Secret;
-import com.nimbusds.oauth2.sdk.id.ClientID;
-import com.nimbusds.oauth2.sdk.id.State;
-import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
-import com.nimbusds.openid.connect.sdk.claims.UserInfo;
-import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
-import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
-
-import org.testng.Assert;
-
-/** {@link EncryptProcessedToken} unit test. */
-public class EncryptProcessedTokenTest {
-
- private ProfileRequestContext prc;
-
- private EncryptProcessedToken action;
-
- private RequestContext requestCtx;
-
- private OIDCMetadataContext oidcCtx;
-
- private OIDCAuthenticationResponseContext oidcRespCtx;
-
- private KeyPair kp;
-
- private EncryptionContext encCtx;
-
- @BeforeMethod
- public void setup() throws ComponentInitializationException, NoSuchAlgorithmException, JOSEException {
- requestCtx = new RequestContextBuilder().buildRequestContext();
- prc = new WebflowRequestContextProfileRequestContextLookup().apply(requestCtx);
- final AuthenticationRequest req = new AuthenticationRequest.Builder(new ResponseType("code"), new Scope("openid"),
- new ClientID("000123"), URI.create("https://example.com/callback")).state(new State()).build();
- prc.getInboundMessageContext().setMessage(req);
- oidcCtx = prc.getInboundMessageContext().getSubcontext(OIDCMetadataContext.class, true);
- oidcRespCtx = new OIDCAuthenticationResponseContext();
- prc.getOutboundMessageContext().addSubcontext(oidcRespCtx);
- final OIDCClientMetadata metaData = new OIDCClientMetadata();
- final OIDCClientInformation information = new OIDCClientInformation(new ClientID("test"), null, metaData,
- new Secret("ultimatetopsecretultimatetopsecret"), null, null);
- oidcCtx.setClientInformation(information);
- final BaseContext ctx = prc.getSubcontext(RelyingPartyContext.class, true);
- encCtx = (EncryptionContext) ctx.getSubcontext(EncryptionContext.class, true);
- final EncryptionParameters params = new EncryptionParameters();
- final KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA");
- kpg.initialize(2048);
- kp = kpg.generateKeyPair();
- BasicJWKCredential credentialRSA = new BasicJWKCredential();
- credentialRSA.setPublicKey(kp.getPublic());
- credentialRSA.setKid("myKid");
- params.setKeyTransportEncryptionCredential(credentialRSA);
- params.setKeyTransportEncryptionAlgorithm("RSA-OAEP-256");
- params.setDataEncryptionAlgorithm("A128CBC-HS256");
- encCtx.setAssertionEncryptionParameters(params);
- final JWSSigner signer = new RSASSASigner(kp.getPrivate());
- final SignedJWT signed =
- new SignedJWT(new JWSHeader(JWSAlgorithm.RS256), new JWTClaimsSet.Builder().subject("alice").build());
- signed.sign(signer);
- oidcRespCtx.setProcessedToken(signed);
- action = new EncryptProcessedToken();
- action.initialize();
- }
-
- /**
- * Test success basic case. Encrypts ProcessedToken.
- */
- @Test
- public void testSuccess() {
- final Event event = action.execute(requestCtx);
- ActionTestingSupport.assertProceedEvent(event);
- Assert.assertTrue(oidcRespCtx.getProcessedToken() instanceof EncryptedJWT);
- final EncryptedJWT jwe = (EncryptedJWT) oidcRespCtx.getProcessedToken();
- Assert.assertEquals("myKid", jwe.getHeader().getKeyID());
-
- }
-
- /**
- * Test success case of encrypting unsigned userinfo.
- */
- @Test
- public void testSuccessUserInfo() {
- oidcRespCtx.setProcessedToken(null);
- final JSONObject info = new JSONObject();
- info.put("sub", "alice");
- oidcRespCtx.setUserInfo(new UserInfo(info));
- final Event event = action.execute(requestCtx);
- ActionTestingSupport.assertProceedEvent(event);
- Assert.assertTrue(oidcRespCtx.getProcessedToken() instanceof EncryptedJWT);
- }
-
- /**
- * Test success basic case using EC. Encrypts ProcessedToken.
- *
- * @throws NoSuchAlgorithmException
- */
- @Test
- public void testSuccessEC() throws NoSuchAlgorithmException {
- final EncryptionParameters params = new EncryptionParameters();
- final KeyPairGenerator kpg = KeyPairGenerator.getInstance("EC");
- kpg.initialize(256);
- kp = kpg.generateKeyPair();
- final BasicJWKCredential credentialEC = new BasicJWKCredential();
- credentialEC.setPublicKey(kp.getPublic());
- params.setKeyTransportEncryptionCredential(credentialEC);
- params.setKeyTransportEncryptionAlgorithm("ECDH-ES");
- params.setDataEncryptionAlgorithm("A128CBC-HS256");
- encCtx.setAssertionEncryptionParameters(params);
- final Event event = action.execute(requestCtx);
- ActionTestingSupport.assertProceedEvent(event);
- Assert.assertTrue(oidcRespCtx.getProcessedToken() instanceof EncryptedJWT);
- }
-
- /**
- * Test case of nothing to encrypt.
- */
- @Test
- public void testNoInput() {
- oidcRespCtx.setProcessedToken(null);
- final Event event = action.execute(requestCtx);
- ActionTestingSupport.assertProceedEvent(event);
- }
-
- /**
- * Test case of missing encryption context.
- */
- @Test
- public void testFailNoEncryptionContext() {
- prc.getSubcontext(RelyingPartyContext.class, false).removeSubcontext(EncryptionContext.class);
- final Event event = action.execute(requestCtx);
- ActionTestingSupport.assertEvent(event, EventIds.INVALID_PROFILE_CTX);
- }
-
- /**
- * Test case of missing encryption parameters. Should do nothing.
- */
- @Test
- public void testSuccessNoEnc() throws ParseException {
- prc.getSubcontext(RelyingPartyContext.class, false).getSubcontext(EncryptionContext.class, false)
- .setAssertionEncryptionParameters(null);
- final Event event = action.execute(requestCtx);
- ActionTestingSupport.assertProceedEvent(event);
- Assert.assertEquals("alice", oidcRespCtx.getProcessedToken().getJWTClaimsSet().getSubject());
- }
-
- /**
- * Strategy cannot be set after initialization
- */
- @Test(expectedExceptions = UnmodifiableComponentException.class)
- public void testInitializationFail() {
- action.setEncryptionContextLookupStrategy(
- new ChildContextLookup<>(EncryptionContext.class).compose(
- new ChildContextLookup<>(RelyingPartyContext.class)));
- }
-
- /**
- * Strategy cannot be null
- */
- @Test(expectedExceptions = ConstraintViolationException.class)
- public void testInitializationFail2() {
- action = new EncryptProcessedToken();
- action.setEncryptionContextLookupStrategy(null);
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/PopulateOIDCEncryptionParametersTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/PopulateOIDCEncryptionParametersTest.java
deleted file mode 100644
index 967f2329..00000000
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/PopulateOIDCEncryptionParametersTest.java
+++ /dev/null
@@ -1,162 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.profile.impl;
-
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.idp.profile.testing.ActionTestingSupport;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-import net.shibboleth.utilities.java.support.logic.ConstraintViolationException;
-import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
-import net.shibboleth.utilities.java.support.resolver.ResolverException;
-
-import java.security.NoSuchAlgorithmException;
-
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.saml.saml2.profile.context.EncryptionContext;
-import org.opensaml.xmlsec.EncryptionParameters;
-import org.opensaml.xmlsec.EncryptionParametersResolver;
-import org.testng.Assert;
-import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Test;
-
-import com.google.common.base.Predicates;
-
-/** {@link PopulateOIDCEncryptionParameters} unit test. */
-public class PopulateOIDCEncryptionParametersTest extends BaseOIDCResponseActionTest {
-
- private PopulateOIDCEncryptionParameters action;
-
- private MockEncryptionParametersResolver resolver;
-
- @BeforeMethod
- private void init() throws ComponentInitializationException {
- action = new PopulateOIDCEncryptionParameters();
- resolver = new MockEncryptionParametersResolver();
- action.setEncryptionParametersResolver(resolver);
- action.initialize();
- }
-
- /**
- * Test basic success case for encryption.
- */
- @Test
- public void testSuccessEncryption() throws NoSuchAlgorithmException, ComponentInitializationException {
- ActionTestingSupport.assertProceedEvent(action.execute(requestCtx));
- Assert.assertNotNull(profileRequestCtx.getSubcontext(RelyingPartyContext.class)
- .getSubcontext(EncryptionContext.class).getAssertionEncryptionParameters());
- }
-
- /**
- * Test basic success case for decryption.
- */
- @Test
- public void testSuccessDecryption() throws NoSuchAlgorithmException, ComponentInitializationException {
- action = new PopulateOIDCEncryptionParameters();
- action.setForDecryption(true);
- action.setEncryptionParametersResolver(new MockEncryptionParametersResolver());
- action.initialize();
-
- ActionTestingSupport.assertProceedEvent(action.execute(requestCtx));
- Assert.assertNotNull(profileRequestCtx.getSubcontext(RelyingPartyContext.class)
- .getSubcontext(EncryptionContext.class).getAttributeEncryptionParameters());
- }
-
- /**
- * Test success case for failing to resolve when failing is an option.
- */
- @Test
- public void testSuccessFailsToResolve() throws NoSuchAlgorithmException, ComponentInitializationException {
- resolver.resolve = false;
-
- action = new PopulateOIDCEncryptionParameters();
- action.setEncryptionOptionalPredicate(Predicates.alwaysTrue());
- action.setEncryptionParametersResolver(resolver);
- action.initialize();
-
- ActionTestingSupport.assertProceedEvent(action.execute(requestCtx));
- Assert.assertNull(profileRequestCtx.getSubcontext(RelyingPartyContext.class)
- .getSubcontext(EncryptionContext.class).getAssertionEncryptionParameters());
- }
-
- /**
- * Test failing to resolve when failing is not an option.
- */
- @Test
- public void testFailureFailsToResolve() throws NoSuchAlgorithmException, ComponentInitializationException {
- resolver.resolve = false;
-
- action = new PopulateOIDCEncryptionParameters();
- action.setEncryptionOptionalPredicate(Predicates.alwaysFalse());
- action.setEncryptionParametersResolver(resolver);
- action.initialize();
- ActionTestingSupport.assertEvent(action.execute(requestCtx), EventIds.INVALID_SEC_CFG);
- }
-
- /**
- * Test setting null strategy for configurations.
- */
- @Test(expectedExceptions = ConstraintViolationException.class)
- public void testFailureNullStrategyConf() {
- action = new PopulateOIDCEncryptionParameters();
- action.setConfigurationLookupStrategy(null);
- }
-
- /**
- * Test setting null strategy for encryption context.
- */
- @Test(expectedExceptions = ConstraintViolationException.class)
- public void testFailureNullStrategyEncrContext() {
- action = new PopulateOIDCEncryptionParameters();
- action.setEncryptionContextLookupStrategy(null);
- }
-
- /**
- * Test setting null strategy for metadata context.
- */
- @Test(expectedExceptions = ConstraintViolationException.class)
- public void testFailureNullStrategyMetadataContext() {
- action = new PopulateOIDCEncryptionParameters();
- action.setOidcMetadataContextLookupStrategy(null);
- }
-
- /**
- * Test setting null strategy for encryption params resolver.
- */
- @Test(expectedExceptions = ConstraintViolationException.class)
- public void testFailureNullStrategyEncrParamas() {
- action = new PopulateOIDCEncryptionParameters();
- action.setEncryptionParametersResolver(null);
- }
-
- public class MockEncryptionParametersResolver implements EncryptionParametersResolver {
-
- public boolean resolve = true;
-
- @Override
- public Iterable<EncryptionParameters> resolve(CriteriaSet criteria) throws ResolverException {
- return null;
- }
-
- @Override
- public EncryptionParameters resolveSingle(CriteriaSet criteria) throws ResolverException {
- return resolve ? new EncryptionParameters() : null;
- }
-
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SignIDTokenTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SignIDTokenTest.java
deleted file mode 100644
index b2e805d5..00000000
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SignIDTokenTest.java
+++ /dev/null
@@ -1,199 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.profile.impl;
-
-import java.net.URISyntaxException;
-import java.security.interfaces.ECPublicKey;
-import java.security.interfaces.RSAPublicKey;
-import java.time.Instant;
-
-import net.shibboleth.idp.profile.testing.ActionTestingSupport;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.security.credential.Credential;
-import org.opensaml.xmlsec.SignatureSigningParameters;
-import org.opensaml.xmlsec.context.SecurityParametersContext;
-import org.springframework.webflow.execution.Event;
-import org.testng.Assert;
-import org.testng.annotations.Test;
-import com.nimbusds.jose.JOSEException;
-import com.nimbusds.jose.JWSVerifier;
-import com.nimbusds.jose.crypto.ECDSAVerifier;
-import com.nimbusds.jose.crypto.MACVerifier;
-import com.nimbusds.jose.crypto.RSASSAVerifier;
-import com.nimbusds.oauth2.sdk.ParseException;
-import com.nimbusds.jwt.SignedJWT;
-
-/** {@link SignIDToken} unit test. */
-public class SignIDTokenTest extends BaseOIDCResponseActionTest {
-
- private SignIDToken action = new SignIDToken();
-
- SecurityParametersContext spCtx;
-
- private void init(String algo, Credential credential) throws ComponentInitializationException, URISyntaxException {
- action.initialize();
- spCtx = new SecurityParametersContext();
- final SignatureSigningParameters params = new SignatureSigningParameters();
- spCtx.setSignatureSigningParameters(params);
- params.setSigningCredential(credential);
- params.setSignatureAlgorithm(algo);
- profileRequestCtx.addSubcontext(spCtx);
- }
-
- /**
- * Test that action does nothing if there is no sec ctx
- */
- @Test
- public void testNoSecCtx() throws ComponentInitializationException {
- action.initialize();
- final Event event = action.execute(requestCtx);
- ActionTestingSupport.assertProceedEvent(event);
- Assert.assertNull(respCtx.getProcessedToken());
- }
-
- /**
- * Test that action does nothing if there is no signing parameters
- */
- @Test
- public void testNoSigningParameters() throws ComponentInitializationException, URISyntaxException {
- init("RS256", credentialRSA);
- spCtx.setSignatureSigningParameters(null);
- final Event event = action.execute(requestCtx);
- ActionTestingSupport.assertProceedEvent(event);
- Assert.assertNull(respCtx.getProcessedToken());
- }
-
- /**
- * Test that action fails if there is no id token
- */
- @Test
- public void testNoIdToken() throws ComponentInitializationException, URISyntaxException {
- init("RS256", credentialRSA);
- final Event event = action.execute(requestCtx);
- respCtx.setIDToken(null);
- ActionTestingSupport.assertEvent(event, EventIds.INVALID_MSG_CTX);
- }
-
- private void testSuccessMessage(JWSVerifier verifier)
- throws ComponentInitializationException, URISyntaxException, JOSEException, ParseException {
- setIdTokenToResponseContext("iss", "sub", "aud", Instant.now(), Instant.now());
- final Event event = action.execute(requestCtx);
- ActionTestingSupport.assertProceedEvent(event);
- Assert.assertNotNull(respCtx.getProcessedToken());
- Assert.assertTrue(((SignedJWT) respCtx.getProcessedToken()).verify(verifier));
-
- }
-
- /**
- * Test that action is able to form success message.
- */
- @Test
- public void testSuccessMessageRS256()
- throws ComponentInitializationException, URISyntaxException, JOSEException, ParseException {
- init("RS256", credentialRSA);
- testSuccessMessage(new RSASSAVerifier((RSAPublicKey) credentialRSA.getPublicKey()));
-
- }
-
- /**
- * Test that action is able to form success message.
- */
- @Test
- public void testSuccessMessageRS384()
- throws ComponentInitializationException, URISyntaxException, JOSEException, ParseException {
- init("RS384", credentialRSA);
- testSuccessMessage(new RSASSAVerifier((RSAPublicKey) credentialRSA.getPublicKey()));
- }
-
- /**
- * Test that action is able to form success message.
- */
- @Test
- public void testSuccessMessageRS512()
- throws ComponentInitializationException, URISyntaxException, JOSEException, ParseException {
- init("RS512", credentialRSA);
- testSuccessMessage(new RSASSAVerifier((RSAPublicKey) credentialRSA.getPublicKey()));
-
- }
-
- /**
- * Test that action is able to form success message.
- */
- @Test
- public void testSuccessMessageES256()
- throws ComponentInitializationException, URISyntaxException, JOSEException, ParseException {
- init("ES256", credentialEC256);
- testSuccessMessage(new ECDSAVerifier((ECPublicKey) credentialEC256.getPublicKey()));
-
- }
-
- /**
- * Test that action is able to form success message.
- */
- @Test
- public void testSuccessMessageES384()
- throws ComponentInitializationException, URISyntaxException, JOSEException, ParseException {
- init("ES384", credentialEC384);
- testSuccessMessage(new ECDSAVerifier((ECPublicKey) credentialEC384.getPublicKey()));
-
- }
-
- /**
- * Test that action is able to form success message.
- */
- @Test
- public void testSuccessMessageES512()
- throws ComponentInitializationException, URISyntaxException, JOSEException, ParseException {
- init("ES512", credentialEC521);
- testSuccessMessage(new ECDSAVerifier((ECPublicKey) credentialEC521.getPublicKey()));
-
- }
-
- /**
- * Test that action is able to form success message.
- *
- */
- @Test
- public void testSuccessMessageHS256()
- throws ComponentInitializationException, URISyntaxException, JOSEException, ParseException {
- init("HS256", credentialHMAC);
- testSuccessMessage(new MACVerifier(credentialHMAC.getSecretKey()));
- }
-
- /**
- * Test that action is able to form success message.
- */
- @Test
- public void testSuccessMessageHS384()
- throws ComponentInitializationException, URISyntaxException, JOSEException, ParseException {
- init("HS384", credentialHMAC);
- testSuccessMessage(new MACVerifier(credentialHMAC.getSecretKey()));
- }
-
- /**
- * Test that action is able to form success message.
- */
- @Test
- public void testSuccessMessageHS512()
- throws ComponentInitializationException, URISyntaxException, JOSEException, ParseException {
- init("HS512", credentialHMAC);
- testSuccessMessage(new MACVerifier(credentialHMAC.getSecretKey()));
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/security/impl/OIDCClientInformationEncryptionParametersResolverTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/security/impl/OIDCClientInformationEncryptionParametersResolverTest.java
deleted file mode 100644
index 5058b3dc..00000000
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/security/impl/OIDCClientInformationEncryptionParametersResolverTest.java
+++ /dev/null
@@ -1,177 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.security.impl;
-
-import java.net.URI;
-import java.text.ParseException;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Date;
-import java.util.List;
-
-import org.mockito.Mockito;
-import org.opensaml.core.testing.OpenSAMLInitBaseTestCase;
-import org.opensaml.security.credential.Credential;
-import org.opensaml.xmlsec.EncryptionConfiguration;
-import org.opensaml.xmlsec.EncryptionParameters;
-import org.opensaml.xmlsec.criterion.EncryptionConfigurationCriterion;
-import org.springframework.core.io.ClassPathResource;
-import org.testng.Assert;
-import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Test;
-import com.nimbusds.jose.EncryptionMethod;
-import com.nimbusds.jose.JWEAlgorithm;
-import com.nimbusds.jose.jwk.JWKSet;
-import com.nimbusds.jose.jwk.RSAKey;
-import com.nimbusds.oauth2.sdk.auth.Secret;
-import com.nimbusds.oauth2.sdk.id.ClientID;
-import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
-import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
-
-import net.shibboleth.idp.plugin.oidc.op.criterion.ClientInformationCriterion;
-import net.shibboleth.idp.plugin.oidc.op.profile.spring.factory.BasicJWKCredentialFactoryBean;
-import net.shibboleth.idp.plugin.oidc.op.security.impl.OIDCClientInformationEncryptionParametersResolver.ParameterType;
-import net.shibboleth.oidc.jwk.RemoteJwkSetCache;
-import net.shibboleth.oidc.security.impl.OIDCDecryptionParameters;
-import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
-
-/**
- * Tests for {@link OIDCClientInformationEncryptionParametersResolver}.
- */
-public class OIDCClientInformationEncryptionParametersResolverTest extends OpenSAMLInitBaseTestCase {
-
- private OIDCClientInformationEncryptionParametersResolver resolver;
-
- private CriteriaSet criteria;
-
- private OIDCClientMetadata metaData;
-
- private JWKSet jwkSet;
-
- @BeforeMethod
- protected void setUp() throws ParseException {
- jwkSet = JWKSet.parse("{\n" + " \"keys\": [\n" + " {\n" + " \"kty\": \"EC\",\n"
- + " \"d\": \"MeEUizlBfHEfftMzSUYmtltJr87NUn2WZqxKDVPMlxM\",\n" + " \"crv\": \"P-256\",\n"
- + " \"x\": \"psUf_1U4lV0u2zSRjVepDMyLV4JeLoWNcz3F3C91z4Y\",\n"
- + " \"y\": \"z29JaoRl_1wgGPEKq7-5qvts9vbEwA7hk5Vg01h8ESc\"\n" + " },\n" + " {\n"
- + " \"kty\": \"RSA\",\n"
- + " \"kid\": \"testRsaKey\",\n"
- + " \"d\": \"RBl-MjdugxTrjVbbWSeArOV7HUiZPX5LWmyB9p3P1OLSSYjK9A42KYPsdcLpa78Den5_fcpLv-1pm8161ATE9Y_O2aIkeg0_IRlM-FLo-KHvtGkEuHcbERPGhrvmsyMsqkVGADhEwvcGsWZ9PZSHo8OK8EsHZWmE2kHN_rG_8n9-ymAvdsHHv5WhyppHtScLWR1UoIQVbnmcw0cauBy-6SYL2pnweWMeI5UDB6eYyeUyA8BuV-_40K0XqJgJ--6zkNdsSrAMbOejfSyAgK7ezCCP-gmS2P3tBLqwJKjCcoDGFihHj6qLUFNWDY5flp3vA02Z8DQKroeAtIN0_PSBIQ\",\n"
- + " \"e\": \"AQAB\",\n"
- + " \"n\": \"xC18p5gfcin62WKas_DlmwUE0ySwmgW51gDQhqucBBSyHMvzRXzRY1cYkox4WCLreC3X8YbNgAv9fjkagX35aNyafnJxEd3Cipf6-h_tZ8Ky5mtdKrxpJdGW1mom7Ha8nMAFGmElDtQny2U8pzDUAUvOcOjiI-JRd6WH3wyQtpCtG6YYxhS9SvnvDaNlYN_afPgFdTHt5yn-q854bjF6uG-uZt3J7jf7P6dvqVizDVO9xtCHrjeet4v62yscMZXYi110aMJdtA4nxKGUi9RWCnBoLVRMBei5ZqmsLCozT5KpfVNkjVzZU3vYBKdGw49pIgRqQP-Jx8Sg7JFaaXMBsQ\"\n"
- + " }" + " ]\n" + "}");
- }
-
- protected void initTest(RemoteJwkSetCache remoteJwkSetCache) throws Exception {
- resolver = new OIDCClientInformationEncryptionParametersResolver();
- // Encryption configuration
- List<EncryptionConfiguration> configs = new ArrayList<EncryptionConfiguration>();
- EncryptionConfiguration encConfig = Mockito.mock(EncryptionConfiguration.class);
- Mockito.when(encConfig.getDataEncryptionAlgorithms()).thenReturn(
- Arrays.asList("A128CBC-HS256", "A192CBC-HS384", "A256CBC-HS512", "A128GCM", "A192GCM", "A256GCM"));
- Mockito.when(encConfig.getKeyTransportEncryptionAlgorithms()).thenReturn(
- Arrays.asList("ECDH-ES", "RSA1_5", "RSA-OAEP", "RSA-OAEP-256", "A128GCMKW", "A192GCMKW", "A256GCMKW"));
- List<Credential> encCreds = new ArrayList<Credential>();
- BasicJWKCredentialFactoryBean factory = new BasicJWKCredentialFactoryBean();
- factory.setResource(new ClassPathResource("credentials/idp-encryption-rsa.jwk"));
- factory.afterPropertiesSet();
- encCreds.add(factory.getObject());
- Mockito.when(encConfig.getKeyTransportEncryptionCredentials()).thenReturn(encCreds);
- configs.add(encConfig);
- criteria = new CriteriaSet(new EncryptionConfigurationCriterion(configs));
- metaData = new OIDCClientMetadata();
- metaData.setIDTokenJWEAlg(JWEAlgorithm.RSA_OAEP_256);
- metaData.setIDTokenJWEEnc(EncryptionMethod.A192CBC_HS384);
- metaData.setUserInfoJWEAlg(JWEAlgorithm.A128GCMKW);
- metaData.setUserInfoJWEEnc(EncryptionMethod.A128GCM);
- metaData.setRequestObjectJWEAlg(JWEAlgorithm.RSA_OAEP_256);
- metaData.setRequestObjectJWEEnc(EncryptionMethod.A192GCM);
- if (remoteJwkSetCache != null) {
- resolver.setRemoteJwkSetCache(remoteJwkSetCache);
- metaData.setJWKSetURI(new URI("https://rp.example.org/jwks"));
- } else {
- metaData.setJWKSet(jwkSet);
- }
- OIDCClientInformation clientInformation =
- new OIDCClientInformation(new ClientID(), new Date(), metaData, new Secret("abcdefgh"));
- criteria.add(new ClientInformationCriterion(clientInformation));
- }
-
- @Test
- public void testIdTokenParameters() throws Exception {
- initTest(null);
- EncryptionParameters params = resolver.resolveSingle(criteria);
- Assert.assertEquals("RSA-OAEP-256", params.getKeyTransportEncryptionAlgorithm());
- Assert.assertEquals("A192CBC-HS384", params.getDataEncryptionAlgorithm());
- Assert.assertEquals(((RSAKey) jwkSet.getKeyByKeyId("testRsaKey")).toPublicKey(),
- params.getKeyTransportEncryptionCredential().getPublicKey());
- }
-
- @Test
- public void testIdTokenParametersRemoteKey() throws Exception {
- RemoteJwkSetCache remoteJwkSetCache = Mockito.mock(RemoteJwkSetCache.class);
- Mockito.when(remoteJwkSetCache.fetch(Mockito.any(), Mockito.any())).thenReturn(jwkSet);
- initTest(remoteJwkSetCache);
- EncryptionParameters params = resolver.resolveSingle(criteria);
- Assert.assertEquals("RSA-OAEP-256", params.getKeyTransportEncryptionAlgorithm());
- Assert.assertEquals("A192CBC-HS384", params.getDataEncryptionAlgorithm());
- Assert.assertEquals(((RSAKey) jwkSet.getKeyByKeyId("testRsaKey")).toPublicKey(),
- params.getKeyTransportEncryptionCredential().getPublicKey());
- }
-
- @Test
- public void testIdTokenParametersNoKey() throws Exception {
- RemoteJwkSetCache remoteJwkSetCache = Mockito.mock(RemoteJwkSetCache.class);
- Mockito.when(remoteJwkSetCache.fetch(Mockito.any(), Mockito.any())).thenReturn(null);
- initTest(remoteJwkSetCache);
- EncryptionParameters params = resolver.resolveSingle(criteria);
- Assert.assertNotEquals(((RSAKey) jwkSet.getKeyByKeyId("testRsaKey")).toPublicKey(),
- params.getKeyTransportEncryptionCredential().getPublicKey());
- }
-
- @Test
- public void testIdTokenParametersDefaultEnc() throws Exception {
- initTest(null);
- metaData.setIDTokenJWEEnc(null);
- EncryptionParameters params = resolver.resolveSingle(criteria);
- Assert.assertEquals("RSA-OAEP-256", params.getKeyTransportEncryptionAlgorithm());
- Assert.assertEquals("A128CBC-HS256", params.getDataEncryptionAlgorithm());
- Assert.assertNotNull(params.getKeyTransportEncryptionCredential().getPublicKey());
- }
-
- @Test
- public void testUserInfoParameters() throws Exception {
- initTest(null);
- resolver.setParameterType(ParameterType.USERINFO_ENCRYPTION);
- EncryptionParameters params = resolver.resolveSingle(criteria);
- Assert.assertEquals("A128GCMKW", params.getKeyTransportEncryptionAlgorithm());
- Assert.assertEquals("A128GCM", params.getDataEncryptionAlgorithm());
- Assert.assertNotNull(params.getKeyTransportEncryptionCredential().getSecretKey());
- }
-
- @Test
- public void testRequesrObjectParameters() throws Exception {
- initTest(null);
- resolver.setParameterType(ParameterType.REQUEST_OBJECT_DECRYPTION);
- EncryptionParameters params = resolver.resolveSingle(criteria);
- Assert.assertEquals("RSA-OAEP-256", params.getKeyTransportEncryptionAlgorithm());
- Assert.assertEquals("A192GCM", params.getDataEncryptionAlgorithm());
- Assert.assertNotNull(
- ((OIDCDecryptionParameters) params).getKeyTransportDecryptionCredentials().get(0).getPrivateKey());
- }
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/security/impl/OIDCClientInformationSignatureSigningParametersResolverTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/security/impl/OIDCClientInformationSignatureSigningParametersResolverTest.java
deleted file mode 100644
index 523e47db..00000000
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/security/impl/OIDCClientInformationSignatureSigningParametersResolverTest.java
+++ /dev/null
@@ -1,216 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.security.impl;
-
-import java.security.interfaces.ECPrivateKey;
-import java.security.interfaces.RSAPrivateKey;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Date;
-import java.util.List;
-
-import org.mockito.Mockito;
-import org.opensaml.core.testing.OpenSAMLInitBaseTestCase;
-import org.opensaml.security.credential.Credential;
-import org.opensaml.xmlsec.SignatureSigningConfiguration;
-import org.opensaml.xmlsec.SignatureSigningParameters;
-import org.opensaml.xmlsec.criterion.SignatureSigningConfigurationCriterion;
-import org.springframework.core.io.ClassPathResource;
-import org.testng.Assert;
-import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Test;
-
-import com.nimbusds.jose.JWSAlgorithm;
-import com.nimbusds.jose.jwk.Curve;
-import com.nimbusds.oauth2.sdk.auth.Secret;
-import com.nimbusds.oauth2.sdk.id.ClientID;
-import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
-import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
-
-import net.shibboleth.idp.plugin.oidc.op.criterion.ClientInformationCriterion;
-import net.shibboleth.idp.plugin.oidc.op.profile.spring.factory.BasicJWKCredentialFactoryBean;
-import net.shibboleth.idp.plugin.oidc.op.security.impl.OIDCClientInformationSignatureSigningParametersResolver.ParameterType;
-import net.shibboleth.oidc.security.impl.OIDCSignatureValidationParameters;
-import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
-import net.shibboleth.utilities.java.support.resolver.ResolverException;
-
-/**
- * Tests for {@link OIDCClientInformationSignatureSigningParametersResolver}.
- */
-public class OIDCClientInformationSignatureSigningParametersResolverTest extends OpenSAMLInitBaseTestCase {
-
- private OIDCClientInformationSignatureSigningParametersResolver resolver;
-
- private CriteriaSet criteria;
-
- private OIDCClientMetadata metaData;
-
- @BeforeMethod
- protected void setUp() throws Exception {
- resolver = new OIDCClientInformationSignatureSigningParametersResolver();
- // Signing configuration
- List<SignatureSigningConfiguration> configs = new ArrayList<SignatureSigningConfiguration>();
- SignatureSigningConfiguration signConfig = Mockito.mock(SignatureSigningConfiguration.class);
- Mockito.when(signConfig.getSignatureAlgorithms())
- .thenReturn(Arrays.asList("RS256", "HS256", "HS384", "HS512", "ES256", "ES384", "ES512"));
- List<Credential> signCreds = new ArrayList<Credential>();
- BasicJWKCredentialFactoryBean factory = new BasicJWKCredentialFactoryBean();
- factory.setResource(new ClassPathResource("credentials/idp-signing-es.jwk"));
- factory.afterPropertiesSet();
- signCreds.add(factory.getObject());
- factory = new BasicJWKCredentialFactoryBean();
- factory.setResource(new ClassPathResource("credentials/idp-signing-es384.jwk"));
- factory.afterPropertiesSet();
- signCreds.add(factory.getObject());
- factory = new BasicJWKCredentialFactoryBean();
- factory.setResource(new ClassPathResource("credentials/idp-signing-es521.jwk"));
- factory.afterPropertiesSet();
- signCreds.add(factory.getObject());
- factory = new BasicJWKCredentialFactoryBean();
- factory.setResource(new ClassPathResource("credentials/idp-signing-rs.jwk"));
- factory.afterPropertiesSet();
- signCreds.add(factory.getObject());
- Mockito.when(signConfig.getSigningCredentials()).thenReturn(signCreds);
- configs.add(signConfig);
- criteria = new CriteriaSet(new SignatureSigningConfigurationCriterion(configs));
- metaData = new OIDCClientMetadata();
- metaData.setIDTokenJWSAlg(JWSAlgorithm.RS256);
- metaData.setUserInfoJWSAlg(JWSAlgorithm.ES256);
- OIDCClientInformation clientInformation =
- new OIDCClientInformation(new ClientID(), new Date(), metaData, new Secret("abcdefgh"));
- criteria.add(new ClientInformationCriterion(clientInformation));
- }
-
- @Test
- public void testIdTokenParameters() throws ResolverException {
- SignatureSigningParameters params = resolver.resolveSingle(criteria);
- Assert.assertEquals(params.getSignatureAlgorithm(), "RS256");
- Assert.assertTrue(params.getSigningCredential().getPrivateKey() instanceof RSAPrivateKey);
- }
-
- @Test
- public void testDefaultIdTokenParameters() throws ResolverException {
- metaData.setIDTokenJWSAlg(null);
- SignatureSigningParameters params = resolver.resolveSingle(criteria);
- Assert.assertEquals(params.getSignatureAlgorithm(), "RS256");
- Assert.assertTrue(params.getSigningCredential().getPrivateKey() instanceof RSAPrivateKey);
- }
-
- @Test
- public void testIdTokenParametersHS() throws ResolverException {
- metaData.setIDTokenJWSAlg(JWSAlgorithm.HS256);
- SignatureSigningParameters params = resolver.resolveSingle(criteria);
- Assert.assertEquals(params.getSignatureAlgorithm(), "HS256");
- Assert.assertNotNull(params.getSigningCredential().getSecretKey());
- }
-
- @Test
- public void testUserInfoParameters() throws ResolverException {
- resolver.setParameterType(ParameterType.USERINFO_SIGNING);
- SignatureSigningParameters params = resolver.resolveSingle(criteria);
- Assert.assertEquals(params.getSignatureAlgorithm(), "ES256");
- Assert.assertTrue(params.getSigningCredential().getPrivateKey() instanceof ECPrivateKey);
- Assert.assertEquals(
- Curve.forECParameterSpec(
- ((java.security.interfaces.ECKey) params.getSigningCredential().getPrivateKey()).getParams()),
- Curve.P_256);
- }
-
- @Test
- public void testUserInfoParametersES384() throws ResolverException {
- metaData.setUserInfoJWSAlg(JWSAlgorithm.ES384);
- resolver.setParameterType(ParameterType.USERINFO_SIGNING);
- SignatureSigningParameters params = resolver.resolveSingle(criteria);
- Assert.assertEquals(params.getSignatureAlgorithm(), "ES384");
- Assert.assertTrue(params.getSigningCredential().getPrivateKey() instanceof ECPrivateKey);
- Assert.assertEquals(
- Curve.forECParameterSpec(
- ((java.security.interfaces.ECKey) params.getSigningCredential().getPrivateKey()).getParams()),
- Curve.P_384);
- }
-
- @Test
- public void testUserInfoParametersES512() throws ResolverException {
- metaData.setUserInfoJWSAlg(JWSAlgorithm.ES512);
- resolver.setParameterType(ParameterType.USERINFO_SIGNING);
- SignatureSigningParameters params = resolver.resolveSingle(criteria);
- Assert.assertEquals(params.getSignatureAlgorithm(), "ES512");
- Assert.assertTrue(params.getSigningCredential().getPrivateKey() instanceof ECPrivateKey);
- Assert.assertEquals(
- Curve.forECParameterSpec(
- ((java.security.interfaces.ECKey) params.getSigningCredential().getPrivateKey()).getParams()),
- Curve.P_521);
- }
-
- protected void testSigningValidationHS256(ParameterType parameterType) throws ResolverException {
- resolver.setParameterType(parameterType);
- OIDCSignatureValidationParameters params = (OIDCSignatureValidationParameters) resolver.resolveSingle(criteria);
- Assert.assertEquals(params.getSignatureAlgorithm(), "HS256");
- Assert.assertTrue(params.getValidationCredentials().size() == 1);
- Assert.assertNotNull(params.getValidationCredentials().get(0).getSecretKey());
- }
-
- protected void testSigningValidationHS384(ParameterType parameterType) throws ResolverException {
- resolver.setParameterType(parameterType);
- OIDCSignatureValidationParameters params = (OIDCSignatureValidationParameters) resolver.resolveSingle(criteria);
- Assert.assertEquals(params.getSignatureAlgorithm(), "HS384");
- Assert.assertTrue(params.getValidationCredentials().size() == 1);
- Assert.assertNotNull(params.getValidationCredentials().get(0).getSecretKey());
- }
-
- protected void testSigningValidationHS512(ParameterType parameterType) throws ResolverException {
- resolver.setParameterType(parameterType);
- OIDCSignatureValidationParameters params = (OIDCSignatureValidationParameters) resolver.resolveSingle(criteria);
- Assert.assertEquals(params.getSignatureAlgorithm(), "HS512");
- Assert.assertTrue(params.getValidationCredentials().size() == 1);
- Assert.assertNotNull(params.getValidationCredentials().get(0).getSecretKey());
- }
-
- protected void testSigningValidationES256(ParameterType parameterType) throws ResolverException {
- resolver.setParameterType(parameterType);
- OIDCSignatureValidationParameters params = (OIDCSignatureValidationParameters) resolver.resolveSingle(criteria);
- Assert.assertEquals(params.getSignatureAlgorithm(), "ES256");
- Assert.assertTrue(params.getValidationCredentials().size() == 1);
- Assert.assertEquals(Curve.forECParameterSpec(
- ((java.security.interfaces.ECKey) params.getValidationCredentials().get(0).getPublicKey()).getParams()),
- Curve.P_256);
- }
-
- protected void testSigningValidationES384(ParameterType parameterType) throws ResolverException {
- resolver.setParameterType(parameterType);
- OIDCSignatureValidationParameters params = (OIDCSignatureValidationParameters) resolver.resolveSingle(criteria);
- Assert.assertEquals(params.getSignatureAlgorithm(), "ES384");
- Assert.assertTrue(params.getValidationCredentials().size() == 1);
- Assert.assertEquals(Curve.forECParameterSpec(
- ((java.security.interfaces.ECKey) params.getValidationCredentials().get(0).getPublicKey()).getParams()),
- Curve.P_384);
- }
-
- protected void testSigningValidationES512(ParameterType parameterType) throws ResolverException {
- resolver.setParameterType(parameterType);
- OIDCSignatureValidationParameters params = (OIDCSignatureValidationParameters) resolver.resolveSingle(criteria);
- Assert.assertEquals(params.getSignatureAlgorithm(), "ES512");
- Assert.assertTrue(params.getValidationCredentials().size() == 2);
- Assert.assertEquals(Curve.forECParameterSpec(
- ((java.security.interfaces.ECKey) params.getValidationCredentials().get(0).getPublicKey()).getParams()),
- Curve.P_521);
- Assert.assertEquals(Curve.forECParameterSpec(
- ((java.security.interfaces.ECKey) params.getValidationCredentials().get(1).getPublicKey()).getParams()),
- Curve.P_521);
- }
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/security/impl/OIDCClientInformationSignatureValidationParametersResolverTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/security/impl/OIDCClientInformationSignatureValidationParametersResolverTest.java
deleted file mode 100644
index 4045ec34..00000000
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/security/impl/OIDCClientInformationSignatureValidationParametersResolverTest.java
+++ /dev/null
@@ -1,269 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.security.impl;
-
-import java.net.URI;
-import java.text.ParseException;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Date;
-import java.util.List;
-
-import org.mockito.Mockito;
-import org.opensaml.core.testing.OpenSAMLInitBaseTestCase;
-import org.opensaml.xmlsec.SignatureSigningConfiguration;
-import org.opensaml.xmlsec.criterion.SignatureSigningConfigurationCriterion;
-import org.testng.Assert;
-import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Test;
-
-import com.nimbusds.jose.JWSAlgorithm;
-import com.nimbusds.jose.jwk.Curve;
-import com.nimbusds.jose.jwk.JWKSet;
-import com.nimbusds.oauth2.sdk.auth.Secret;
-import com.nimbusds.oauth2.sdk.id.ClientID;
-import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
-import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
-
-import net.shibboleth.idp.plugin.oidc.op.criterion.ClientInformationCriterion;
-import net.shibboleth.idp.plugin.oidc.op.security.impl.OIDCClientInformationSignatureValidationParametersResolver.ParameterType;
-import net.shibboleth.oidc.jwk.RemoteJwkSetCache;
-import net.shibboleth.oidc.security.impl.OIDCSignatureValidationParameters;
-import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
-import net.shibboleth.utilities.java.support.resolver.ResolverException;
-
-/**
- * Tests for {@link OIDCClientInformationSignatureValidationParametersResolver}.
- */
-public class OIDCClientInformationSignatureValidationParametersResolverTest extends OpenSAMLInitBaseTestCase {
-
- private OIDCClientInformationSignatureValidationParametersResolver resolver;
-
- private CriteriaSet criteria;
-
- private OIDCClientMetadata metaData;
-
- private JWKSet jwkSet;
-
- @BeforeMethod
- protected void setUp() throws ParseException {
- jwkSet = JWKSet.parse("{\n" + " \"keys\":[\n" + " {\n" + " \"kty\":\"RSA\",\n"
- + " \"e\":\"AQAB\",\n" + " \"use\":\"enc\",\n"
- + " \"kid\":\"testkeyRSAEncryption\",\n"
- + " \"n\":\"47mkdLGrenv7QFkAWv1JryydVjq8HsEVCKz-qRttVe2II1-lQc-4sObf-9X0LtAwdtK0g1_EpRzZNuGaK2nFISr9uZQQ5evNHETgUKE2oKJs3r0wnfgvEZVHV6wXg4B7NRmDBgphExIYndBt__L-tC9_S_isaJOXQ_PAx17621pmxdyg8WEnJx9Azc23vH-Cii0ttMxDLNqUTu-tdgtZ8eo0IX7VPBWAnXVi0bRKHJuuvzJ4B8QqwsZsj8hGrwqNkRMoJVEiz-5M6ACLo-rgGNjtCBJRaezolrHSCc-r-hZbAaBKq0dOPRNPcMtRm8TUdmuRKBY7rXaFi7zGV7XDdw\"\n"
- + " },\n" + " {\n" + " \"kty\":\"RSA\",\n" + " \"e\":\"AQAB\",\n"
- + " \"use\":\"sig\",\n" + " \"kid\":\"testkeyRS\",\n"
- + " \"n\":\"pNf03ghVzMAw5sWrwDAMAZdSYNY2q7OVlxMInljMgz8XB5mf8XKH3EtP7AKrb8IAf7rGhfuH3T1N1C7F-jwIeYjXxMm2nIAZ0hXApgbccvBpf4n2H7IZflMjt4A3tt587QQSxQ069drCP4sYevxhTcLplJy6RWA0cLj-5CHyWy94zPeeA4GRd6xgHFLz0RNiSF0pF0kE4rmRgQVZ-b4_BmD9SsWnIpwhms5Ihciw36WyAGQUeZqULGsfwAMwlNLIaTCBLAoRgv370p-XsLrgz86pTkNBJqXP5GwI-ZfgiLmJuHjQ9l85KqHM87f-QdsqiV8KoRcslgXPqb6VOTJBVw\"\n"
- + " },\n" + " {\n" + " \"kty\":\"EC\",\n" + " \"use\":\"sig\",\n"
- + " \"crv\":\"P-256\",\n" + " \"kid\":\"testkeyES256\",\n"
- + " \"x\":\"2uzfE1oK0cf1_c11SFc9vFdGLnJoH3e0AKTrGPAmUis\",\n"
- + " \"y\":\"14410NGKqwLM58b26ZcvGOruFixpHt_SJTw8I5wwgLQ\"\n" + " },\n" + " {\n"
- + " \"kty\":\"EC\",\n" + " \"use\":\"sig\",\n" + " \"crv\":\"P-384\",\n"
- + " \"kid\":\"testkeyES384\",\n"
- + " \"x\":\"-loVdvssxvUq_jCPULEk0cMkF4uvEGfHfbh8az8T9J_er6frv0jhosDLCxoLE7E6\",\n"
- + " \"y\":\"Er9Blt5x5ADxQXmezf3OEmQbLjjblgB9XwbXXcQyEOQ2qXNv659AgdZiq4UJBnPH\"\n" + " },\n"
- + " {\n" + " \"kty\":\"EC\",\n" + " \"use\":\"sig\",\n"
- + " \"crv\":\"P-521\",\n" + " \"kid\":\"testkeyES512\",\n"
- + " \"x\":\"AVjIdU6xZBwRdC9yZYyqT583EM3GbxdVyGwinPqeba0EildGZWM1L7HfJXV_r_cOBcuCsEZcuSqFO3v5KRLY5Wj-\",\n"
- + " \"y\":\"ATeLywfo7kLDEwUCm8ZQFynqH36WXSdQClAz2cZ63tHfjSumm_SfMOfdWEDmdtgkbVDrBXWYqWoYaofigmDZkxok\"\n"
- + " },\n" + " {\n" + " \"kty\":\"EC\",\n" + " \"crv\":\"P-521\",\n"
- + " \"kid\":\"testkeyES512-2\",\n"
- + " \"x\":\"AQL7ZCkzcAyuUdaqYiCSAf2u2MR_l4rqSppQ8lvEEjmjy7ETiPB77BqeH7glJ6xtkK1YhmHxKDKz0E0zdmqWWVYp\",\n"
- + " \"y\":\"AXI7UFlH-Zy2jEf1XoY3NHblkJDsOK4kiv82fRrKtHAoKM_ud25XNzT3lrfbJ--zZlmWUB7fV2jHR0pbmjOOrEF_\"\n"
- + " }\n" + " ]\n" + "}");
- }
-
- protected void initTest(RemoteJwkSetCache remoteJwkSetCache) throws Exception {
- resolver = new OIDCClientInformationSignatureValidationParametersResolver();
- // Signing configuration
- List<SignatureSigningConfiguration> configs = new ArrayList<SignatureSigningConfiguration>();
- SignatureSigningConfiguration signConfig = Mockito.mock(SignatureSigningConfiguration.class);
- Mockito.when(signConfig.getSignatureAlgorithms())
- .thenReturn(Arrays.asList("RS256", "HS256", "HS384", "HS512", "ES256", "ES384", "ES512"));
- configs.add(signConfig);
- criteria = new CriteriaSet(new SignatureSigningConfigurationCriterion(configs));
- metaData = new OIDCClientMetadata();
- metaData.setRequestObjectJWSAlg(JWSAlgorithm.ES256);
- metaData.setTokenEndpointAuthJWSAlg(JWSAlgorithm.ES256);
- if (remoteJwkSetCache != null) {
- resolver.setRemoteJwkSetCache(remoteJwkSetCache);
- metaData.setJWKSetURI(new URI("https://rp.example.org/jwks"));
- } else {
- metaData.setJWKSet(jwkSet);
- }
- OIDCClientInformation clientInformation =
- new OIDCClientInformation(new ClientID(), new Date(), metaData, new Secret("abcdefgh"));
- criteria.add(new ClientInformationCriterion(clientInformation));
- }
-
- @Test
- public void testRequestObjectParameters() throws Exception {
- initTest(null);
- testSigningValidationES256(ParameterType.REQUEST_OBJECT_VALIDATION);
- }
-
- @Test
- public void testRequestObjectParametersRemoteKeys() throws Exception {
- RemoteJwkSetCache remoteJwkSetCache = Mockito.mock(RemoteJwkSetCache.class);
- Mockito.when(remoteJwkSetCache.fetch(Mockito.any(), Mockito.any())).thenReturn(jwkSet);
- initTest(remoteJwkSetCache);
- testSigningValidationES256(ParameterType.REQUEST_OBJECT_VALIDATION);
- }
-
- @Test
- public void testRequestObjectParametersNoKeys() throws Exception {
- RemoteJwkSetCache remoteJwkSetCache = Mockito.mock(RemoteJwkSetCache.class);
- Mockito.when(remoteJwkSetCache.fetch(Mockito.any(), Mockito.any())).thenReturn(null);
- initTest(remoteJwkSetCache);
- resolver.setParameterType(ParameterType.REQUEST_OBJECT_VALIDATION);
- Assert.assertNull(resolver.resolveSingle(criteria));
- }
-
- @Test
- public void testRequestObjectParametersES384() throws Exception {
- initTest(null);
- metaData.setRequestObjectJWSAlg(JWSAlgorithm.ES384);
- testSigningValidationES384(ParameterType.REQUEST_OBJECT_VALIDATION);
- }
-
- @Test
- public void testRequestObjectParametersES512() throws Exception {
- initTest(null);
- metaData.setRequestObjectJWSAlg(JWSAlgorithm.ES512);
- testSigningValidationES512(ParameterType.REQUEST_OBJECT_VALIDATION);
- }
-
- @Test
- public void testRequestObjectParametersHS256() throws Exception {
- initTest(null);
- metaData.setRequestObjectJWSAlg(JWSAlgorithm.HS256);
- testSigningValidationHS256(ParameterType.REQUEST_OBJECT_VALIDATION);
- }
-
- @Test
- public void testRequestObjectParametersHS384() throws Exception {
- initTest(null);
- metaData.setRequestObjectJWSAlg(JWSAlgorithm.HS384);
- testSigningValidationHS384(ParameterType.REQUEST_OBJECT_VALIDATION);
- }
-
- @Test
- public void testRequestObjectParametersHS512() throws Exception {
- initTest(null);
- metaData.setRequestObjectJWSAlg(JWSAlgorithm.HS512);
- testSigningValidationHS512(ParameterType.REQUEST_OBJECT_VALIDATION);
- }
-
- @Test
- public void testTokenEndpointJwtParameters() throws Exception {
- initTest(null);
- testSigningValidationES256(ParameterType.TOKEN_ENDPOINT_JWT_VALIDATION);
- }
-
- @Test
- public void testTokenEndpointJwtParametersES384() throws Exception {
- initTest(null);
- metaData.setTokenEndpointAuthJWSAlg(JWSAlgorithm.ES384);
- testSigningValidationES384(ParameterType.TOKEN_ENDPOINT_JWT_VALIDATION);
- }
-
- @Test
- public void testTokenEndpointJwtParametersES512() throws Exception {
- initTest(null);
- metaData.setTokenEndpointAuthJWSAlg(JWSAlgorithm.ES512);
- testSigningValidationES512(ParameterType.TOKEN_ENDPOINT_JWT_VALIDATION);
- }
-
- @Test
- public void testTokenEndpointJwtParametersHS256() throws Exception {
- initTest(null);
- metaData.setTokenEndpointAuthJWSAlg(JWSAlgorithm.HS256);
- testSigningValidationHS256(ParameterType.TOKEN_ENDPOINT_JWT_VALIDATION);
- }
-
- @Test
- public void testTokenEndpointJwtParametersHS384() throws Exception {
- initTest(null);
- metaData.setTokenEndpointAuthJWSAlg(JWSAlgorithm.HS384);
- testSigningValidationHS384(ParameterType.TOKEN_ENDPOINT_JWT_VALIDATION);
- }
-
- @Test
- public void testTokenEndpointJwtParametersHS512() throws Exception {
- initTest(null);
- metaData.setTokenEndpointAuthJWSAlg(JWSAlgorithm.HS512);
- testSigningValidationHS512(ParameterType.TOKEN_ENDPOINT_JWT_VALIDATION);
- }
-
- protected void testSigningValidationHS256(ParameterType parameterType) throws ResolverException {
- resolver.setParameterType(parameterType);
- OIDCSignatureValidationParameters params = (OIDCSignatureValidationParameters) resolver.resolveSingle(criteria);
- Assert.assertEquals(params.getSignatureAlgorithm(), "HS256");
- Assert.assertTrue(params.getValidationCredentials().size() == 1);
- Assert.assertNotNull(params.getValidationCredentials().get(0).getSecretKey());
- }
-
- protected void testSigningValidationHS384(ParameterType parameterType) throws ResolverException {
- resolver.setParameterType(parameterType);
- OIDCSignatureValidationParameters params = (OIDCSignatureValidationParameters) resolver.resolveSingle(criteria);
- Assert.assertEquals(params.getSignatureAlgorithm(), "HS384");
- Assert.assertTrue(params.getValidationCredentials().size() == 1);
- Assert.assertNotNull(params.getValidationCredentials().get(0).getSecretKey());
- }
-
- protected void testSigningValidationHS512(ParameterType parameterType) throws ResolverException {
- resolver.setParameterType(parameterType);
- OIDCSignatureValidationParameters params = (OIDCSignatureValidationParameters) resolver.resolveSingle(criteria);
- Assert.assertEquals(params.getSignatureAlgorithm(), "HS512");
- Assert.assertTrue(params.getValidationCredentials().size() == 1);
- Assert.assertNotNull(params.getValidationCredentials().get(0).getSecretKey());
- }
-
- protected void testSigningValidationES256(ParameterType parameterType) throws ResolverException {
- resolver.setParameterType(parameterType);
- OIDCSignatureValidationParameters params = (OIDCSignatureValidationParameters) resolver.resolveSingle(criteria);
- Assert.assertEquals(params.getSignatureAlgorithm(), "ES256");
- Assert.assertTrue(params.getValidationCredentials().size() == 1);
- Assert.assertEquals(Curve.forECParameterSpec(
- ((java.security.interfaces.ECKey) params.getValidationCredentials().get(0).getPublicKey()).getParams()),
- Curve.P_256);
- }
-
- protected void testSigningValidationES384(ParameterType parameterType) throws ResolverException {
- resolver.setParameterType(parameterType);
- OIDCSignatureValidationParameters params = (OIDCSignatureValidationParameters) resolver.resolveSingle(criteria);
- Assert.assertEquals(params.getSignatureAlgorithm(), "ES384");
- Assert.assertTrue(params.getValidationCredentials().size() == 1);
- Assert.assertEquals(Curve.forECParameterSpec(
- ((java.security.interfaces.ECKey) params.getValidationCredentials().get(0).getPublicKey()).getParams()),
- Curve.P_384);
- }
-
- protected void testSigningValidationES512(ParameterType parameterType) throws ResolverException {
- resolver.setParameterType(parameterType);
- OIDCSignatureValidationParameters params = (OIDCSignatureValidationParameters) resolver.resolveSingle(criteria);
- Assert.assertEquals(params.getSignatureAlgorithm(), "ES512");
- Assert.assertTrue(params.getValidationCredentials().size() == 2);
- Assert.assertEquals(Curve.forECParameterSpec(
- ((java.security.interfaces.ECKey) params.getValidationCredentials().get(0).getPublicKey()).getParams()),
- Curve.P_521);
- Assert.assertEquals(Curve.forECParameterSpec(
- ((java.security.interfaces.ECKey) params.getValidationCredentials().get(1).getPublicKey()).getParams()),
- Curve.P_521);
- }
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/SignUserInfoResponseTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/SignUserInfoResponseTest.java
deleted file mode 100644
index 27e57542..00000000
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/SignUserInfoResponseTest.java
+++ /dev/null
@@ -1,222 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.userinfo.profile.impl;
-
-import java.net.URISyntaxException;
-import java.security.interfaces.ECPublicKey;
-import java.security.interfaces.RSAPublicKey;
-
-import net.shibboleth.idp.plugin.oidc.op.profile.impl.BaseOIDCResponseActionTest;
-import net.shibboleth.idp.profile.testing.ActionTestingSupport;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.security.credential.Credential;
-import org.opensaml.xmlsec.SignatureSigningParameters;
-import org.opensaml.xmlsec.context.SecurityParametersContext;
-import org.springframework.webflow.execution.Event;
-import org.testng.Assert;
-import org.testng.annotations.Test;
-import com.nimbusds.jose.JOSEException;
-import com.nimbusds.jose.JWSAlgorithm;
-import com.nimbusds.jose.JWSVerifier;
-import com.nimbusds.jose.crypto.ECDSAVerifier;
-import com.nimbusds.jose.crypto.MACVerifier;
-import com.nimbusds.jose.crypto.RSASSAVerifier;
-import com.nimbusds.oauth2.sdk.ParseException;
-import com.nimbusds.oauth2.sdk.id.Subject;
-import com.nimbusds.openid.connect.sdk.claims.UserInfo;
-import com.nimbusds.jwt.SignedJWT;
-
-/** {@link SignUserInfoResponse} unit test. */
-public class SignUserInfoResponseTest extends BaseOIDCResponseActionTest {
-
- private SignUserInfoResponse action = new SignUserInfoResponse();
-
- SecurityParametersContext spCtx;
-
- private void init(String algo, Credential credential) throws ComponentInitializationException, URISyntaxException {
- metadataCtx.getClientInformation().getOIDCMetadata().setUserInfoJWSAlg(JWSAlgorithm.parse(algo));
- action.initialize();
- spCtx = new SecurityParametersContext();
- SignatureSigningParameters params = new SignatureSigningParameters();
- spCtx.setSignatureSigningParameters(params);
- params.setSigningCredential(credential);
- params.setSignatureAlgorithm(algo);
- profileRequestCtx.addSubcontext(spCtx);
- respCtx.setUserInfo(new UserInfo(new Subject("sub")));
- }
-
- /**
- * Test that action does nothing if there is no sufficient underlying contexts or not requested.
- */
- @Test
- public void testNoCredential() throws ComponentInitializationException, URISyntaxException {
- init("RS256", credentialRSA);
- spCtx.getSignatureSigningParameters().setSigningCredential(null);
- Event event = action.execute(requestCtx);
- ActionTestingSupport.assertProceedEvent(event);
- Assert.assertNull(respCtx.getProcessedToken());
- }
-
- /**
- * Test that action does nothing if there is no sufficient underlying contexts or not requested.
- */
- @Test
- public void testNoParameters() throws ComponentInitializationException, URISyntaxException {
- init("RS256", credentialRSA);
- spCtx.setSignatureSigningParameters(null);
- Event event = action.execute(requestCtx);
- ActionTestingSupport.assertProceedEvent(event);
- Assert.assertNull(respCtx.getProcessedToken());
- }
-
- /**
- * Test that action does nothing if there is no sufficient underlying contexts or not requested.
- */
- @Test
- public void testNoCtxt() throws ComponentInitializationException, URISyntaxException {
- init("RS256", credentialRSA);
- profileRequestCtx.removeSubcontext(SecurityParametersContext.class);
- Event event = action.execute(requestCtx);
- ActionTestingSupport.assertProceedEvent(event);
- Assert.assertNull(respCtx.getProcessedToken());
- }
-
- /**
- * Test that action does nothing if there is no sufficient underlying contexts or not requested.
- */
- @Test
- public void testNotInstructed() throws ComponentInitializationException, URISyntaxException {
- init("RS256", credentialRSA);
- metadataCtx.getClientInformation().getOIDCMetadata().setUserInfoJWSAlg(null);
- Event event = action.execute(requestCtx);
- ActionTestingSupport.assertProceedEvent(event);
- Assert.assertNull(respCtx.getProcessedToken());
- }
-
- /**
- * Test that action fails if there is no user info
- */
- @Test
- public void testNoUserInfo() throws ComponentInitializationException, URISyntaxException {
- init("RS256", credentialRSA);
- respCtx.setUserInfo(null);
- final Event event = action.execute(requestCtx);
- ActionTestingSupport.assertEvent(event, EventIds.INVALID_MSG_CTX);
- }
-
- private void testSuccessMessage(JWSVerifier verifier)
- throws ComponentInitializationException, URISyntaxException, JOSEException, ParseException {
- final Event event = action.execute(requestCtx);
- ActionTestingSupport.assertProceedEvent(event);
- Assert.assertNotNull(respCtx.getProcessedToken());
- Assert.assertTrue(((SignedJWT) respCtx.getProcessedToken()).verify(verifier));
- }
-
- /**
- * Test that action is able to form success message.
- */
- @Test
- public void testSuccessMessageRS256()
- throws ComponentInitializationException, URISyntaxException, JOSEException, ParseException {
- init("RS256", credentialRSA);
- testSuccessMessage(new RSASSAVerifier((RSAPublicKey) credentialRSA.getPublicKey()));
- }
-
- /**
- * Test that action is able to form success message.
- */
- @Test
- public void testSuccessMessageRS384()
- throws ComponentInitializationException, URISyntaxException, JOSEException, ParseException {
- init("RS384", credentialRSA);
- testSuccessMessage(new RSASSAVerifier((RSAPublicKey) credentialRSA.getPublicKey()));
- }
-
- /**
- * Test that action is able to form success message.
- */
- @Test
- public void testSuccessMessageRS512()
- throws ComponentInitializationException, URISyntaxException, JOSEException, ParseException {
- init("RS512", credentialRSA);
- testSuccessMessage(new RSASSAVerifier((RSAPublicKey) credentialRSA.getPublicKey()));
- }
-
- /**
- * Test that action is able to form success message.
- */
- @Test
- public void testSuccessMessageES256()
- throws ComponentInitializationException, URISyntaxException, JOSEException, ParseException {
- init("ES256", credentialEC256);
- testSuccessMessage(new ECDSAVerifier((ECPublicKey) credentialEC256.getPublicKey()));
- }
-
- /**
- * Test that action is able to form success message.
- */
- @Test
- public void testSuccessMessageES384()
- throws ComponentInitializationException, URISyntaxException, JOSEException, ParseException {
- init("ES384", credentialEC384);
- testSuccessMessage(new ECDSAVerifier((ECPublicKey) credentialEC384.getPublicKey()));
- }
-
- /**
- * Test that action is able to form success message.
- */
- @Test
- public void testSuccessMessageES512()
- throws ComponentInitializationException, URISyntaxException, JOSEException, ParseException {
- init("ES512", credentialEC521);
- testSuccessMessage(new ECDSAVerifier((ECPublicKey) credentialEC521.getPublicKey()));
- }
-
- /**
- * Test that action is able to form success message.
- */
- @Test
- public void testSuccessMessageHS256()
- throws ComponentInitializationException, URISyntaxException, JOSEException, ParseException {
- init("HS256", credentialHMAC);
- testSuccessMessage(new MACVerifier(credentialHMAC.getSecretKey()));
- }
-
- /**
- * Test that action is able to form success message.
- */
- @Test
- public void testSuccessMessageHS384()
- throws ComponentInitializationException, URISyntaxException, JOSEException, ParseException {
- init("HS384", credentialHMAC);
- testSuccessMessage(new MACVerifier(credentialHMAC.getSecretKey()));
- }
-
- /**
- * Test that action is able to form success message.
- */
- @Test
- public void testSuccessMessageHS512()
- throws ComponentInitializationException, URISyntaxException, JOSEException, ParseException {
- init("HS512", credentialHMAC);
- testSuccessMessage(new MACVerifier(credentialHMAC.getSecretKey()));
- }
-
-}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list