[java-idp-oidc] 02/02: JCOMOIDC-41 - Move OIDC Signature Validation resolvers and parameter classes to commons

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=a92b99ba81a02398ace3929d201fba63322692fd

commit a92b99ba81a02398ace3929d201fba63322692fd
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Jan 27 17:35:12 2023 +0200

    JCOMOIDC-41 - Move OIDC Signature Validation resolvers and parameter classes to commons
    
    https://shibboleth.atlassian.net/browse/JCOMOIDC-41
---
 .../idp/service/relying-party/postconfig.xml       | 65 ++++++++++++++++++----
 1 file changed, 55 insertions(+), 10 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index d2cef902..3e410f2a 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -59,7 +59,8 @@
         p:authorizeCodeLifetime="%{idp.oidc.authorizeCode.defaultLifetime:PT5M}"
         p:encodeConsentInTokens="%{idp.oidc.encodeConsentInTokens:false}"
         p:encodedAttributes="%{idp.oidc.encodedAttributes:%{idp.oidc.embeddedAttributes:}}"
-        p:deniedUserInfoAttributes="%{idp.oidc.deniedUserInfoAttributes:}" />
+        p:deniedUserInfoAttributes="%{idp.oidc.deniedUserInfoAttributes:}"
+        p:securityConfiguration-ref="%{idp.security.oidc.authorize.config:shibboleth.oidc.authorize.DefaultSecurityConfiguration}" />
 
     <bean id="OIDC.UserInfo" parent="AbstractOIDCProfile" lazy-init="true"
         class="net.shibboleth.oidc.profile.config.OIDCUserInfoConfiguration"
@@ -330,6 +331,11 @@
             <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="authorizationCodeClaimsSetManipulationStrategy"
                 p:propertyType="#{T(java.util.function.BiFunction)}" />
         </property>
+        <property name="securityConfigurationLookupStrategy">
+            <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="securityConfiguration"
+                p:propertyType="#{T(net.shibboleth.idp.profile.config.SecurityConfiguration)}"
+                p:defaultValue-ref="%{idp.security.oidc.authorize.config:shibboleth.oidc.authorize.DefaultSecurityConfiguration}" />
+        </property>
     </bean>
     
     <bean id="OIDC.UserInfo.MDDriven" parent="AbstractMDDrivenOIDCProfile" lazy-init="true"
@@ -721,7 +727,23 @@
             <ref bean="#{'%{idp.oidc.rodecrypt.config:shibboleth.oidc.DecryptionConfiguration}'.trim()}" />
         </property>
         <property name="jwtSignatureValidationConfiguration">
-            <ref bean="#{'%{idp.oidc.rovalid.config:shibboleth.oidc.SignatureValidationConfiguration}'.trim()}" />
+            <ref bean="#{'%{idp.oidc.tevalid.config:shibboleth.oidc.SignatureValidationConfiguration}'.trim()}" />
+        </property>
+    </bean>
+
+    <bean id="shibboleth.oidc.authorize.DefaultSecurityConfiguration"
+        class="net.shibboleth.oidc.profile.config.JSONSecurityConfiguration">
+        <property name="jwtSignatureSigningConfiguration">
+            <ref bean="#{'%{idp.oidc.signing.config:shibboleth.oidc.SigningConfiguration}'.trim()}" />
+        </property>
+        <property name="jwtEncryptionConfiguration">
+            <ref bean="#{'%{idp.oidc.encryption.config:shibboleth.oidc.EncryptionConfiguration}'.trim()}" />
+        </property>
+        <property name="jwtDecryptionConfiguration">
+            <ref bean="#{'%{idp.oidc.rodecrypt.config:shibboleth.oidc.DecryptionConfiguration}'.trim()}" />
+        </property>
+        <property name="jwtSignatureValidationConfiguration">
+            <ref bean="#{'%{idp.oidc.rovalid.config:shibboleth.oidc.ro.SignatureValidationConfiguration}'.trim()}" />
         </property>
     </bean>
         
@@ -851,7 +873,7 @@
         <constructor-arg>
             <list>
                 <bean id="CriterionCredentialResolver"
-                    class="net.shibboleth.oidc.security.credential.impl.CriterionCredentialResolver" />
+                    class="net.shibboleth.oidc.security.credential.impl.ClientSecretCriterionCredentialResolver" />
             </list>
         </constructor-arg>
     </bean>
@@ -871,14 +893,14 @@
                     </constructor-arg>
                 </bean>
                 <bean id="CriterionCredentialResolver"
-                    class="net.shibboleth.oidc.security.credential.impl.CriterionCredentialResolver" />
+                    class="net.shibboleth.oidc.security.credential.impl.ClientSecretCriterionCredentialResolver" />
             </list>
         </constructor-arg>
     </bean>
 
     <!-- Configuration for supported algorithms for request object signature validation. -->
     <bean id="shibboleth.oidc.SignatureValidationConfiguration" parent="shibboleth.oidc.BasicSignatureValidationConfiguration"
-        p:signatureTrustEngine-ref="ExplicitKeySignedJWTTrustEngine">
+        p:signatureTrustEngine-ref="ClientInformationTokenEndpointAuthJWTTrustEngine">
 <!--
         <property name="signatureAlgorithms">
             <list>
@@ -905,6 +927,11 @@
 -->
     </bean>
 
+    <!-- Configuration for supported algorithms for request object signature validation. -->
+    <bean id="shibboleth.oidc.ro.SignatureValidationConfiguration" parent="shibboleth.oidc.BasicSignatureValidationConfiguration"
+        p:signatureTrustEngine-ref="ClientInformationRequestObjectJWTTrustEngine">
+    </bean>
+
     <!-- A resolver for resolving trusted credentials to match against those resolved from the JWT -->
     <bean id="defaultSignedJWTTrustedCredentialResolver"
         class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
@@ -915,7 +942,7 @@
                     p:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache" 
                     p:keyFetchInterval="%{idp.oidc.provider.keyfetch.interval:PT30M}"/>
                 <bean id="CriterionCredentialResolver"
-                    class="net.shibboleth.oidc.security.credential.impl.CriterionCredentialResolver" />
+                    class="net.shibboleth.oidc.security.credential.impl.ClientSecretCriterionCredentialResolver" />
             </list>
         </constructor-arg>
     </bean>
@@ -924,12 +951,30 @@
     <bean id="defaultSignedJWTJOSEHeaderCredentialResolver"
         class="net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver" />
 
-    <bean id="ExplicitKeySignedJWTTrustEngine"
-        class="net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine"
+    <bean id="ClientInformationTokenEndpointAuthJWTTrustEngine"
+        class="net.shibboleth.oidc.security.impl.ClientInformationJWTTrustEngine"
         c:resolver-ref="defaultSignedJWTTrustedCredentialResolver"
-        c:JOSEObjectResolver-ref="defaultSignedJWTJOSEHeaderCredentialResolver" />
+        c:JOSEObjectResolver-ref="defaultSignedJWTJOSEHeaderCredentialResolver">
+        <constructor-arg name="signatureAlgorithmLookupStrategy">
+            <bean
+                class="net.shibboleth.oidc.profile.config.navigate.ClientInformationStringValueLookupFunction"
+                c:keyName="token_endpoint_auth_signing_alg" />
+        </constructor-arg>
+        <constructor-arg name="defaultAlgorithmValue" value="" />
+    </bean>
+
+    <bean id="ClientInformationRequestObjectJWTTrustEngine"
+        class="net.shibboleth.oidc.security.impl.ClientInformationJWTTrustEngine"
+        c:resolver-ref="defaultSignedJWTTrustedCredentialResolver"
+        c:JOSEObjectResolver-ref="defaultSignedJWTJOSEHeaderCredentialResolver">
+        <constructor-arg name="signatureAlgorithmLookupStrategy">
+            <bean
+                class="net.shibboleth.oidc.profile.config.navigate.ClientInformationStringValueLookupFunction"
+                c:keyName="request_object_signing_alg" />
+        </constructor-arg>
+        <constructor-arg name="defaultAlgorithmValue" value="" />
+    </bean>
 
-    
     <!--  Configuration for publishing key set. -->
     <bean id="shibboleth.oidc.PublishKeySetSecurityConfiguration"
         class="net.shibboleth.oidc.profile.config.JSONSecurityConfiguration">

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.