[java-idp-plugin-oidc-rp] branch main updated: Harmonize RP classes with those from oidc-common
Phil Smart
philip.smart at jisc.ac.uk
Mon Jan 9 10:34:46 UTC 2023
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=4489f868ae760caaedb88e14d8601d72dbb1d432
The following commit(s) were added to refs/heads/main by this push:
new 4489f86 Harmonize RP classes with those from oidc-common
4489f86 is described below
commit 4489f868ae760caaedb88e14d8601d72dbb1d432
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Mon Jan 9 10:34:43 2023 +0000
Harmonize RP classes with those from oidc-common
---
...ializeBlankOutboundResponseMessageContext.java} | 4 +-
.../rp/impl/PopulateJWTDecryptionParameters.java | 225 ---------------
.../rp/impl/PopulateJWTEncryptionParameters.java | 321 ---------------------
.../oidc-relying-party-authn-beans.xml | 6 +-
.../idp/flows/oidc/rp/keyset/keyset-beans.xml | 2 +-
5 files changed, 6 insertions(+), 552 deletions(-)
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeSimpleOutboundResponseMessageContext.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeBlankOutboundResponseMessageContext.java
similarity index 92%
rename from idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeSimpleOutboundResponseMessageContext.java
rename to idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeBlankOutboundResponseMessageContext.java
index 9c9346a..e1f6d09 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeSimpleOutboundResponseMessageContext.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeBlankOutboundResponseMessageContext.java
@@ -32,11 +32,11 @@ import net.shibboleth.idp.profile.AbstractProfileAction;
*
* @event {@link org.opensaml.profile.action.EventIds#PROCEED_EVENT_ID}
*/
-public class InitializeSimpleOutboundResponseMessageContext extends AbstractProfileAction {
+public class InitializeBlankOutboundResponseMessageContext extends AbstractProfileAction {
/** Class logger. */
@Nonnull
- private final Logger log = LoggerFactory.getLogger(InitializeSimpleOutboundResponseMessageContext.class);
+ private final Logger log = LoggerFactory.getLogger(InitializeBlankOutboundResponseMessageContext.class);
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/PopulateJWTDecryptionParameters.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/PopulateJWTDecryptionParameters.java
deleted file mode 100644
index 8827d9a..0000000
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/PopulateJWTDecryptionParameters.java
+++ /dev/null
@@ -1,225 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
-
-import java.util.List;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
-import org.opensaml.profile.action.ActionSupport;
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
-import org.opensaml.xmlsec.context.SecurityParametersContext;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import net.shibboleth.idp.profile.AbstractProfileAction;
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
-import net.shibboleth.oidc.security.JWTDecryptionConfiguration;
-import net.shibboleth.oidc.security.JWTDecryptionParameters;
-import net.shibboleth.oidc.security.JWTDecryptionParametersResolver;
-import net.shibboleth.oidc.security.JWTEncryptionConfiguration;
-import net.shibboleth.oidc.security.context.JWTSecurityParametersContext;
-import net.shibboleth.oidc.security.criterion.JWTDecryptionConfigurationCriterion;
-import net.shibboleth.oidc.security.criterion.StaticCredentialCriterion;
-import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-import net.shibboleth.utilities.java.support.component.ComponentSupport;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
-import net.shibboleth.utilities.java.support.resolver.ResolverException;
-
-/**
- * Action that resolves and populates {@link JWTDecryptionParameters} on an {@link JWTSecurityParametersContext}
- * created/accessed via a lookup function, by default on a child of the outbound message context.
- *
- * <p>The default, per-RelyingParty, and default per-profile {@link JWTEncryptionConfiguration}
- * objects are input to the resolution process, along with any static, symmetric key credentials
- * configured on the relying party i.e. the client_secret.</p>
- *
- * @event {@link EventIds#PROCEED_EVENT_ID}
- * @event {@link EventIds#INVALID_PROFILE_CTX}
- * @event {@link EventIds#INVALID_SEC_CFG}
- * @post set the decryption parameters onto the security parameters context
- */
-public class PopulateJWTDecryptionParameters extends AbstractProfileAction {
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(PopulateJWTDecryptionParameters.class);
-
- /** Strategy used to look up the {@link SecurityParametersContext} to set the parameters for. */
- @Nonnull
- private Function<ProfileRequestContext,JWTSecurityParametersContext> securityParametersContextLookupStrategy;
-
- /** Strategy used to lookup a per-request {@link JWTDecryptionConfiguration} list. */
- @NonnullAfterInit
- private Function<ProfileRequestContext,List<JWTDecryptionConfiguration>> configurationLookupStrategy;
-
- /** Lookup function for relying party context. */
- @Nonnull private Function<ProfileRequestContext,RelyingPartyContext> relyingPartyContextLookupStrategy;
-
- /** Resolver for parameters to store into context. */
- @NonnullAfterInit private JWTDecryptionParametersResolver resolver;
-
- /**
- * Constructor.
- */
- public PopulateJWTDecryptionParameters() {
- // Create context by default.
- securityParametersContextLookupStrategy =
- new ChildContextLookup<>(JWTSecurityParametersContext.class, true).compose(
- new InboundMessageContextLookup());
- relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
- }
-
- /**
- * Set lookup strategy for relying party context.
- *
- * @param strategy lookup strategy
- */
- public void setRelyingPartyContextLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,RelyingPartyContext> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- relyingPartyContextLookupStrategy =
- Constraint.isNotNull(strategy, "RelyingPartyContext lookup strategy cannot be null");
- }
-
- /**
- * Set the resolver to use for the parameters to store into the context.
- *
- * @param newResolver resolver to use
- */
- public void setDecryptionParametersResolver(@Nonnull final JWTDecryptionParametersResolver newResolver) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- resolver = Constraint.isNotNull(newResolver, "DecryptionParametersResolver cannot be null");
- }
-
- /**
- * Set the strategy used to look up a per-request {@link JWTDecryptionConfiguration} list.
- *
- * @param strategy lookup strategy
- */
- public void setConfigurationLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, List<JWTDecryptionConfiguration>> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- configurationLookupStrategy = Constraint.isNotNull(strategy,
- "DecryptionConfiguration lookup strategy cannot be null");
- }
-
- /**
- * Set the strategy used to look up the {@link SecurityParametersContext} to set the parameters for.
- *
- * @param strategy lookup strategy
- */
- public void setSecurityParametersContextLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, JWTSecurityParametersContext> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- securityParametersContextLookupStrategy = Constraint.isNotNull(strategy,
- "SecurityParametersContext lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
-
- if (resolver == null) {
- throw new ComponentInitializationException("DecryptionParametersResolver cannot be null");
- }
- if (configurationLookupStrategy == null) {
- throw new ComponentInitializationException("DecryptionConfiguraitonLookup cannot be null");
- }
- }
-
- @Override
- protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
-
- log.debug("{} Resolving JWT DecryptionParameters for request", getLogPrefix());
-
- final List<JWTDecryptionConfiguration> configs = configurationLookupStrategy.apply(profileRequestContext);
- if (configs == null || configs.isEmpty()) {
- log.error("{} No DecryptionConfigurations returned by lookup strategy", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_SEC_CFG);
- return;
- }
-
- final JWTSecurityParametersContext paramsCtx =
- securityParametersContextLookupStrategy.apply(profileRequestContext);
- if (paramsCtx == null) {
- log.debug("{} No SecurityParametersContext returned by lookup strategy", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
- return;
- }
-
- try {
- final JWTDecryptionParameters params =
- resolver.resolveSingle(buildCriteriaSet(profileRequestContext, configs));
- paramsCtx.setDecryptionParameters(params);
- log.debug("{} {} DecryptionParameters", getLogPrefix(),
- params != null ? "Resolved" : "Failed to resolve");
- } catch (final ResolverException e) {
- log.error("{} Error resolving DecryptionParameters", getLogPrefix(), e);
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_SEC_CFG);
- }
-
- }
-
- /**
- * Build the criteria used as input to the {@link JWTDecryptionParametersResolver}.
- *
- * @param profileRequestContext current profile request context
- * @param configs a list of {@link JWTDecryptionConfiguration}s to add to the criteria set.
- *
- * @return the criteria set to use
- */
- @Nonnull
- private CriteriaSet buildCriteriaSet(@Nonnull final ProfileRequestContext profileRequestContext,
- final List<JWTDecryptionConfiguration> configs) {
-
- final CriteriaSet criteria = new CriteriaSet();
- criteria.add(new JWTDecryptionConfigurationCriterion(configs));
-
- // Build a static credential criteria. Extract the decryption credential from the RP config.
- final RelyingPartyContext rpCtx = relyingPartyContextLookupStrategy.apply(profileRequestContext);
- if (rpCtx != null && rpCtx.getConfiguration() != null &&
- rpCtx.getProfileConfig() instanceof OIDCAuthorizationConfiguration) {
- final OIDCAuthorizationConfiguration profileConfiguration =
- (OIDCAuthorizationConfiguration) rpCtx.getProfileConfig();
-
- if (profileConfiguration != null) {
- criteria.add(new StaticCredentialCriterion(
- profileConfiguration.getClientCredential(profileRequestContext)));
- } else {
- log.warn("{} Profile configuration not available, client credential missing", getLogPrefix());
- }
- }
-
- return criteria;
-
- }
-
-}
-
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/PopulateJWTEncryptionParameters.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/PopulateJWTEncryptionParameters.java
deleted file mode 100644
index 5b50b43..0000000
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/PopulateJWTEncryptionParameters.java
+++ /dev/null
@@ -1,321 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
-
-import java.util.List;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
-import org.opensaml.profile.action.ActionSupport;
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.profile.context.navigate.OutboundMessageContextLookup;
-import org.opensaml.security.credential.UsageType;
-import org.opensaml.security.criteria.UsageCriterion;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import net.shibboleth.idp.profile.AbstractProfileAction;
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
-import net.shibboleth.oidc.metadata.context.OIDCProviderMetadataContext;
-import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
-import net.shibboleth.oidc.security.JWTEncryptionConfiguration;
-import net.shibboleth.oidc.security.JWTEncryptionParameters;
-import net.shibboleth.oidc.security.JWTEncryptionParametersResolver;
-import net.shibboleth.oidc.security.context.JWTSecurityParametersContext;
-import net.shibboleth.oidc.security.criterion.ClientInformationCriterion;
-import net.shibboleth.oidc.security.criterion.JWTEncryptionConfigurationCriterion;
-import net.shibboleth.oidc.security.criterion.ProviderMetadataCriterion;
-import net.shibboleth.oidc.security.criterion.StaticCredentialCriterion;
-import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
-import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-import net.shibboleth.utilities.java.support.component.ComponentSupport;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
-import net.shibboleth.utilities.java.support.resolver.ResolverException;
-
-/**
- * Action that resolves and populates {@link JWTEncryptionParameters} on an {@link JWTSecurityParametersContext}
- * created/accessed via a lookup function, by default on a child of the outbound message context.
- *
- * <p>The resolution process is contingent on the active profile configuration requesting encryption.</p>
- *
- * <p>The default, per-RelyingParty, and default per-profile {@link JWTEncryptionConfiguration}
- * objects are input to the resolution process, along with the relying party's client metadata, any static
- * credentials configured on the relying party, and the OpenID Provider metadata (which in most cases
- * will be the source of the eventual encryption key)</p>
- *
- * @event {@link EventIds#PROCEED_EVENT_ID}
- * @event {@link EventIds#INVALID_PROFILE_CTX}
- * @event {@link EventIds#INVALID_SEC_CFG}
- * @post set the encryption parameters onto the security parameters context
- */
-//TODO similar to PopulateOIDCEncryptionParameters? shall we merge into commons, adds the OP metadata from downstream
-// If exists, useful for proxy.
-public class PopulateJWTEncryptionParameters extends AbstractProfileAction {
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(PopulateJWTEncryptionParameters.class);
-
- /** A friendly name to log as the subject of encryption parameter resolution.*/
- @Nonnull private String forFriendlyName;
-
- /** Strategy used to look up the {@link JWTSecurityParametersContext} to extract parameters from. */
- @Nonnull
- private Function<ProfileRequestContext,JWTSecurityParametersContext> securityParametersContextLookupStrategy;
-
- /** Strategy used to look up a per-request {@link JWTEncryptionConfiguration} list. */
- @NonnullAfterInit
- private Function<ProfileRequestContext,List<JWTEncryptionConfiguration>> configurationLookupStrategy;
-
- /** Resolver for parameters to store into context. */
- @NonnullAfterInit private JWTEncryptionParametersResolver encParamsresolver;
-
- /** Active configurations to feed into resolver. */
- @Nullable @NonnullElements private List<JWTEncryptionConfiguration> encryptionConfigurations;
-
- /** Strategy used to look up a OIDC client metadata context. */
- @Nullable private Function<ProfileRequestContext, OIDCMetadataContext> oidcClientMetadataContextLookupStrategy;
-
- /** Strategy used to look up a OIDC provider metadata context. */
- @Nullable
- private Function<ProfileRequestContext, OIDCProviderMetadataContext> oidcProviderMetadataContextLookupStrategy;
-
- /** Lookup function for relying party context. */
- @Nonnull private Function<ProfileRequestContext, RelyingPartyContext> relyingPartyContextLookupStrategy;
-
- /** Context to populate. */
- private JWTSecurityParametersContext encryptionContext;
-
- /** Constructor. */
- public PopulateJWTEncryptionParameters() {
- forFriendlyName = "not-specified";
- securityParametersContextLookupStrategy =
- new ChildContextLookup<>(JWTSecurityParametersContext.class, true).compose(
- new OutboundMessageContextLookup());
- oidcClientMetadataContextLookupStrategy = new ChildContextLookup<>(OIDCMetadataContext.class);
- oidcProviderMetadataContextLookupStrategy = new ChildContextLookup<>(OIDCProviderMetadataContext.class);
- relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
- }
-
- /**
- * Set lookup strategy for relying party context.
- *
- * @param strategy lookup strategy
- */
- public void setRelyingPartyContextLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, RelyingPartyContext> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- relyingPartyContextLookupStrategy =
- Constraint.isNotNull(strategy, "RelyingPartyContext lookup strategy cannot be null");
- }
-
- /**
- * Set the lookup strategy to locate the security parameters context.
- *
- * @param strategy the lookup strategy
- */
- public void setSecurityParametersContextLookupStrategy(
- final Function<ProfileRequestContext, JWTSecurityParametersContext> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
-
- securityParametersContextLookupStrategy = Constraint.isNotNull(strategy,
- "securityParametersContextLookupStrategy can not be null");
- }
-
- /**
- * Set lookup strategy for {@link OIDCMetadataContext} for input to resolution.
- *
- * @param strategy lookup strategy
- */
- public void setClientMetadataContextLookupStrategy(
- @Nullable final Function<ProfileRequestContext, OIDCMetadataContext> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- oidcClientMetadataContextLookupStrategy = strategy;
- }
-
- /**
- * Set lookup strategy for {@link OIDCProviderMetadataContext} for input to resolution.
- *
- * @param strategy lookup strategy
- */
- public void setProviderMetadataContextLookupStrategy(
- @Nullable final Function<ProfileRequestContext, OIDCProviderMetadataContext> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- oidcProviderMetadataContextLookupStrategy = strategy;
- }
-
- /**
- * Set the friendly name to log as the subject of encryption parameter resolution.
- *
- * @param name the friendly name
- */
- public void setForFriendlyName(@Nonnull @NotEmpty final String name) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
-
- forFriendlyName = Constraint.isNotEmpty(name, "ForFriendlyName can not be null or empty");
- }
-
- /**
- * Set the strategy used to look up a per-request {@link JWTEncryptionConfiguration} list.
- *
- * @param strategy lookup strategy
- */
- public void setConfigurationLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, List<JWTEncryptionConfiguration>> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
-
- configurationLookupStrategy =
- Constraint.isNotNull(strategy, "EncryptionConfiguration lookup strategy cannot be null");
- }
-
- /**
- * Set the encParamsresolver to use for the parameters to store into the context.
- *
- * @param newResolver encParamsresolver to use
- */
- public void setEncryptionParametersResolver(@Nonnull final JWTEncryptionParametersResolver newResolver) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- encParamsresolver = Constraint.isNotNull(newResolver, "EncryptionParametersResolver cannot be null");
- }
-
- @Override
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
-
- if (encParamsresolver == null) {
- throw new ComponentInitializationException("EncryptionParametersResolver cannot be null");
- }
- }
-
- @Override
- protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- if (!super.doPreExecute(profileRequestContext)) {
- log.debug("{} Encryption disabled for '{}'", getLogPrefix(), forFriendlyName);
- return false;
- }
-
- encryptionContext = securityParametersContextLookupStrategy.apply(profileRequestContext);
- if (encryptionContext == null) {
- log.debug("{} No EncryptionContext returned by lookup strategy", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
- return false;
- }
- return true;
- }
-
-
- // Checkstyle: CyclomaticComplexity OFF
- @Override
- protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
-
- log.debug("{} Resolving EncryptionParameters for '{}' encryption", getLogPrefix(),forFriendlyName);
-
- try {
- encryptionConfigurations = configurationLookupStrategy.apply(profileRequestContext);
- if (encryptionConfigurations == null || encryptionConfigurations.isEmpty()) {
- throw new ResolverException("No EncryptionConfigurations returned by lookup strategy");
- }
- final CriteriaSet criteria = buildCriteriaSet(profileRequestContext);
- final JWTEncryptionParameters params = encParamsresolver.resolveSingle(criteria);
-
- if (params != null) {
- log.debug("{} Resolved EncryptionParameters for {}", getLogPrefix(),forFriendlyName);
- encryptionContext.setEncryptionParameters(params);
- } else {
- log.warn("{} Resolver returned no EncryptionParameters", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_SEC_CFG);
- }
- } catch (final ResolverException e) {
- log.error("{} Error resolving EncryptionParameters", getLogPrefix(), e);
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_SEC_CFG);
- }
- }
-// Checkstyle: CyclomaticComplexity ON
-
- /**
- * Build the criteria used as input to the {@link JWTEncryptionParametersResolver}.
- *
- * @param profileRequestContext current profile request context
- *
- * @return the criteria set to use
- */
- @Nonnull
- private CriteriaSet buildCriteriaSet(@Nonnull final ProfileRequestContext profileRequestContext) {
-
- final CriteriaSet criteria = new CriteriaSet(
- new JWTEncryptionConfigurationCriterion(encryptionConfigurations));
-
- criteria.add(new UsageCriterion(UsageType.ENCRYPTION));
-
- // Add client metadata criterion
- final OIDCMetadataContext oidcMetadataCtx =
- oidcClientMetadataContextLookupStrategy.apply(profileRequestContext);
- if (oidcMetadataCtx != null && oidcMetadataCtx.getClientInformation() != null) {
- log.debug(
- "{} Adding OIDC client information to resolution criteria for encryption algorithms",
- getLogPrefix());
- criteria.add(new ClientInformationCriterion(oidcMetadataCtx.getClientInformation()));
- } else {
- log.debug("{} No OIDC client information available", getLogPrefix());
- }
-
- // Add OP metadata criterion
- final OIDCProviderMetadataContext oidcProviderMetadataCtx =
- oidcProviderMetadataContextLookupStrategy.apply(profileRequestContext);
- if (oidcProviderMetadataCtx != null && oidcProviderMetadataCtx.getProviderInformation() != null) {
- log.debug("{} Adding OIDC provider information to resolution criteria",
- getLogPrefix());
- criteria.add(new ProviderMetadataCriterion(oidcProviderMetadataCtx.getProviderInformation()));
- } else {
- log.debug("{} OIDCProviderMetadataContext is absent", getLogPrefix());
- }
-
- // Add any static credentials from the RP context. If any resolver supports it
- final RelyingPartyContext rpCtx =
- relyingPartyContextLookupStrategy.apply(profileRequestContext);
- if (rpCtx != null && rpCtx.getConfiguration() != null &&
- rpCtx.getProfileConfig() instanceof OIDCAuthorizationConfiguration) {
- final OIDCAuthorizationConfiguration profileConfiguration =
- (OIDCAuthorizationConfiguration) rpCtx.getProfileConfig();
-
- if (profileConfiguration != null) {
- criteria.add(
- new StaticCredentialCriterion(profileConfiguration.getClientCredential(profileRequestContext)));
- } else {
- log.trace("{} Profile configuration not available, "
- + "shared secret direct encryption credential not present", getLogPrefix());
- }
- }
- return criteria;
- }
-
-}
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
index d37c8b4..17d7bc4 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
@@ -186,7 +186,7 @@
p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
<bean id="PopulateRequestObjectEncryptionParameters"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.PopulateJWTEncryptionParameters" scope="prototype"
+ class="net.shibboleth.oidc.profile.impl.PopulateJWTEncryptionParameters" scope="prototype"
p:forFriendlyName="Request Object"
p:configurationLookupStrategy-ref="RequestObjectEncryptionConfigurationLookup"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
@@ -429,7 +429,7 @@
<!-- TODO should we use an activation condition to decide if decryption params are needed e.g. JWT is not a JWE to stop
redundent resolution of credentials -->
<bean id="PopulateIDTokenDecryptionParameters"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.PopulateJWTDecryptionParameters" scope="prototype"
+ class="net.shibboleth.oidc.profile.impl.PopulateJWTDecryptionParameters" scope="prototype"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
p:configurationLookupStrategy-ref="IDTokenDecryptionConfigurationLookup"
p:decryptionParametersResolver-ref="JWTDecryptionParametersResolver" />
@@ -699,7 +699,7 @@
<!-- FIXME: (might not be an issue) Will populate the same security params context as the id_token, but overwrite the
decryption config. The SAML one uses the same context for signature and decryption, so this seems OK? -->
<bean id="PopulateUserInfoDecryptionParameters"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.PopulateJWTDecryptionParameters" scope="prototype"
+ class="net.shibboleth.oidc.profile.impl.PopulateJWTDecryptionParameters" scope="prototype"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
p:configurationLookupStrategy-ref="UserInfoTokenDecryptionConfigurationLookup"
p:decryptionParametersResolver-ref="JWTDecryptionParametersResolver" />
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/rp/keyset/keyset-beans.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/rp/keyset/keyset-beans.xml
index 25c8b77..bef03d6 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/rp/keyset/keyset-beans.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/rp/keyset/keyset-beans.xml
@@ -27,7 +27,7 @@
p:browserProfile="false" />
<bean id="InitializeOutboundMessageContext"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.InitializeSimpleOutboundResponseMessageContext" scope="prototype" />
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.InitializeBlankOutboundResponseMessageContext" scope="prototype" />
<bean id="InitializeRelyingPartyContext"
class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.InitializeUnverifiedRelyingPartyContext" scope="prototype" />
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list