[java-idp-plugin-oidc-rp] branch dev/JOIDCRP-29 updated: JOIDCRP-29 - Support client_secret_jwt and private_key_jwt client authentication
Phil Smart
philip.smart at jisc.ac.uk
Tue Jun 20 11:17:35 UTC 2023
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch dev/JOIDCRP-29
in repository java-idp-plugin-oidc-rp.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=73c58cb705e7bda453d8b0df91edf006fa38e730
The following commit(s) were added to refs/heads/dev/JOIDCRP-29 by this push:
new 73c58cb JOIDCRP-29 - Support client_secret_jwt and private_key_jwt client authentication
73c58cb is described below
commit 73c58cb705e7bda453d8b0df91edf006fa38e730
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Tue Jun 20 12:17:29 2023 +0100
JOIDCRP-29 - Support client_secret_jwt and private_key_jwt client
authentication
- Cleanup security context location in the context tree
https://shibboleth.atlassian.net/browse/JOIDCRP-29
---
...nitializeOAuth2ClientAuthenticationContext.java | 99 ++++++++++++++++++++++
...zeOAuth2ClientAuthenticationMethodHandler.java} | 9 +-
.../META-INF/net.shibboleth.idp/postconfig.xml | 30 ++++++-
.../oidc-relying-party-authn-beans.xml | 9 +-
...uth2ClientAuthenticationMethodHandlerTest.java} | 8 +-
5 files changed, 144 insertions(+), 11 deletions(-)
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationContext.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationContext.java
new file mode 100644
index 0000000..2fa6e52
--- /dev/null
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationContext.java
@@ -0,0 +1,99 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
+
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.messaging.context.MessageContext;
+import org.opensaml.messaging.context.navigate.ChildContextLookup;
+import org.opensaml.messaging.handler.AbstractMessageHandler;
+import org.opensaml.messaging.handler.MessageHandlerException;
+import org.opensaml.profile.action.EventIds;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import net.shibboleth.oidc.authn.context.OAuth2ClientAuthenticationContext;
+import net.shibboleth.oidc.profile.messaging.context.OIDCPeerEntityContext;
+import net.shibboleth.utilities.java.support.component.ComponentSupport;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+
+/**
+ * An {@link AbstractMessageHandler action} that initializes an {@link OAuth2ClientAuthenticationContext} for later use.
+ *
+ * @event {@link org.opensaml.profile.action.EventIds#PROCEED_EVENT_ID}
+ * @event {@link EventIds#INVALID_PROFILE_CTX}
+ * @post create a {@link OAuth2ClientAuthenticationContext}
+ */
+public class InitializeOAuth2ClientAuthenticationContext extends AbstractMessageHandler {
+
+ /** Class logger. */
+ @Nonnull
+ private final Logger log = LoggerFactory.getLogger(InitializeOAuth2ClientAuthenticationContext.class);
+
+ /**
+ * The strategy used to lookup or create the {@link OAuth2ClientAuthenticationContext}
+ * for storing the client authentication.
+ */
+ @Nonnull private Function<MessageContext, OAuth2ClientAuthenticationContext>
+ oauth2ClientAuthenticationContextLookupStrategy;
+
+
+ /** Constructor.*/
+ public InitializeOAuth2ClientAuthenticationContext() {
+
+ // Default under the OIDC Peer Entity Context, create is true
+ oauth2ClientAuthenticationContextLookupStrategy =
+ new ChildContextLookup<>(OAuth2ClientAuthenticationContext.class, true).compose(
+ new ChildContextLookup<>(OIDCPeerEntityContext.class));
+ }
+
+ /**
+ * Set the strategy to lookup the {@link OAuth2ClientAuthenticationContext}
+ * from the {@link ProfileRequestContext}.
+ *
+ * @param strgy the strategy.
+ */
+ public void setOAuth2ClientAuthenticationContextLookupStrategy(
+ @Nonnull final Function<MessageContext, OAuth2ClientAuthenticationContext> strgy) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+ ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
+
+ oauth2ClientAuthenticationContextLookupStrategy = Constraint.isNotNull(strgy,
+ "OAuth2 client authentication context lookup strategy cannot be null");
+ }
+
+
+ @Override
+ protected void doInvoke(final MessageContext messageContext) throws MessageHandlerException {
+
+ final OAuth2ClientAuthenticationContext context =
+ oauth2ClientAuthenticationContextLookupStrategy.apply(messageContext);
+
+ if (context == null) {
+ throw new MessageHandlerException("No OAuth2 client authentication context found or created");
+ }
+
+ log.debug("{} Initialized OAuth2 Client Authentication Context",getLogPrefix());
+ }
+
+
+
+}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationContextHandler.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationMethodHandler.java
similarity index 98%
rename from idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationContextHandler.java
rename to idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationMethodHandler.java
index 0911e86..ace2306 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationContextHandler.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationMethodHandler.java
@@ -77,7 +77,8 @@ import net.shibboleth.utilities.java.support.logic.Constraint;
/**
* An {@link AbstractMessageHandler action} that resolves the Client Authentication method for the chosen
- * upstream OpenID Provider (issuer) from the profile configuration.
+ * upstream OpenID Provider (issuer) from the profile configuration, and adds it to the
+ * {@link OAuth2ClientAuthenticationContext}.
*
* <p>If a JWT client authentication type, the security parameters context is used create a signed JWT client assertion.
* </p>
@@ -88,11 +89,11 @@ import net.shibboleth.utilities.java.support.logic.Constraint;
* @event {@link IdPEventIds#INVALID_RELYING_PARTY_CONFIG}
* @post Add the {@link ClientAuthenticationMethod} to the {@link OAuth2ClientAuthenticationContext}
*/
-public class InitializeOAuth2ClientAuthenticationContextHandler extends AbstractMessageHandler {
+public class InitializeOAuth2ClientAuthenticationMethodHandler extends AbstractMessageHandler {
/** Class logger. */
@Nonnull
- private final Logger log = LoggerFactory.getLogger(InitializeOAuth2ClientAuthenticationContextHandler.class);
+ private final Logger log = LoggerFactory.getLogger(InitializeOAuth2ClientAuthenticationMethodHandler.class);
/** Lookup function for parent ProfileRequestContext. */
@Nonnull private static final ParentProfileRequestContextLookup<MessageContext> PRC_LOOKUP
@@ -143,7 +144,7 @@ public class InitializeOAuth2ClientAuthenticationContextHandler extends Abstract
/** Constructor.*/
- public InitializeOAuth2ClientAuthenticationContextHandler() {
+ public InitializeOAuth2ClientAuthenticationMethodHandler() {
// Default under the OIDC Peer Entity Context, create is true
oauth2ClientAuthenticationContextLookupStrategy =
new ChildContextLookup<>(OAuth2ClientAuthenticationContext.class, true).compose(
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 952101b..9e12642 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -25,6 +25,16 @@
class="org.opensaml.messaging.context.navigate.ChildContextLookup"
c:type="#{ T(net.shibboleth.oidc.profile.messaging.context.OIDCPeerEntityContext) }" />
+ <bean id="shibboleth.ChildLookupOrCreate.OAuth2ClientAuthenticationContext"
+ class="org.opensaml.messaging.context.navigate.ChildContextLookup"
+ c:type="#{ T(net.shibboleth.oidc.authn.context.OAuth2ClientAuthenticationContext) }"
+ c:createContext="true"/>
+
+ <bean id="shibboleth.ChildLookupOrCreate.SecurityParametersContext"
+ class="org.opensaml.messaging.context.navigate.ChildContextLookup"
+ c:type="#{ T(net.shibboleth.oidc.security.jose.context.SecurityParametersContext) }"
+ c:createContext="true" />
+
<bean id="shibboleth.ChildLookup.AccessTokenResponseContext"
class="org.opensaml.messaging.context.navigate.ChildContextLookup"
c:type="#{ T(net.shibboleth.idp.plugin.authn.oidc.rp.context.AccessTokenResponseContext) }" />
@@ -38,7 +48,7 @@
</constructor-arg>
</bean>
- <bean id="shibboleth.ChildLookup.OIDCProviderMetadataContextFromMessageContext" parent="shibboleth.Functions.Compose">
+ <bean id="shibboleth.ChildLookup.OIDCProviderMetadataContextFromMessageContext" parent="shibboleth.Functions.Compose">
<constructor-arg name="g">
<ref bean="shibboleth.ChildLookup.OIDCProviderMetadataContext" />
</constructor-arg>
@@ -55,6 +65,24 @@
<ref bean="shibboleth.ChildLookup.OIDCPeerEntityFromInbound" />
</constructor-arg>
</bean>
+
+ <bean id="shibboleth.ChildLookupOrCreate.OAuth2ClientAuthenticationContextFromOIDCPeer" parent="shibboleth.Functions.Compose">
+ <constructor-arg name="g">
+ <ref bean="shibboleth.ChildLookupOrCreate.OAuth2ClientAuthenticationContext" />
+ </constructor-arg>
+ <constructor-arg name="f">
+ <ref bean="shibboleth.ChildLookup.OIDCPeerEntityContext" />
+ </constructor-arg>
+ </bean>
+
+ <bean id="shibboleth.ChildLookupOrCreate.SecurityParametersFromOAuth2ClientAuthenticationContext" parent="shibboleth.Functions.Compose">
+ <constructor-arg name="g">
+ <ref bean="shibboleth.ChildLookupOrCreate.SecurityParametersContext" />
+ </constructor-arg>
+ <constructor-arg name="f">
+ <ref bean="shibboleth.ChildLookupOrCreate.OAuth2ClientAuthenticationContextFromOIDCPeer" />
+ </constructor-arg>
+ </bean>
<bean id="shibboleth.ChildLookup.ProviderMetadataFromProviderContext"
class="net.shibboleth.idp.profile.context.navigate.SpringExpressionContextLookupFunction"
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
index 6af816f..90338bf 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
@@ -376,9 +376,13 @@
<bean class="org.opensaml.messaging.handler.impl.BasicMessageHandlerChain">
<property name="handlers">
<list>
+ <bean id="InitializeOAuth2ClientAuthenticationContext" scope="prototype"
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.InitializeOAuth2ClientAuthenticationContext"
+ p:oAuth2ClientAuthenticationContextLookupStrategy-ref="shibboleth.ChildLookupOrCreate.OAuth2ClientAuthenticationContextFromOIDCPeer"/>
<bean id="PopulateJWTClientAuthenticationSignatureSigningParameters" scope="prototype"
class="net.shibboleth.oidc.profile.impl.PopulateJWTSignatureSigningParametersHandler"
p:noResultIsError="true"
+ p:securityParametersContextLookupStrategy-ref="shibboleth.ChildLookupOrCreate.SecurityParametersFromOAuth2ClientAuthenticationContext"
p:providerMetadataContextLookupStrategy-ref="shibboleth.ChildLookup.OIDCProviderMetadataContextFromMessageContext">
<!-- Is only required for client_secret_jwt and private_key_jwt -->
<property name="activationCondition">
@@ -400,8 +404,9 @@
</bean>
</property>
</bean>
- <bean id="InitializeOAuth2ClientAuthenticationContext" scope="prototype"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.InitializeOAuth2ClientAuthenticationContextHandler"
+ <bean id="InitializeOAuth2ClientAuthenticationMethodHandler" scope="prototype"
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.InitializeOAuth2ClientAuthenticationMethodHandler"
+ p:securityParametersContextLookupStrategy-ref="shibboleth.ChildLookupOrCreate.SecurityParametersFromOAuth2ClientAuthenticationContext"
p:jwtBearerExpiryOffset="%{idp.authn.oidc.rp.client.authenticationMethod.jwt.expiryOffset:PT30S}"/>
</list>
</property>
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationContextHandlerTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationMethodHandlerTest.java
similarity index 97%
rename from idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationContextHandlerTest.java
rename to idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationMethodHandlerTest.java
index aade56e..a98ab78 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationContextHandlerTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationMethodHandlerTest.java
@@ -41,16 +41,16 @@ import net.shibboleth.oidc.security.credential.DefaultClientSecretCredential;
import net.shibboleth.oidc.security.jose.SignatureSigningParameters;
import net.shibboleth.oidc.security.jose.context.SecurityParametersContext;
-/** Tests for {@link InitializeOAuth2ClientAuthenticationContextHandler}.*/
-public class InitializeOAuth2ClientAuthenticationContextHandlerTest extends AbstractOIDCTest {
+/** Tests for {@link InitializeOAuth2ClientAuthenticationMethodHandler}.*/
+public class InitializeOAuth2ClientAuthenticationMethodHandlerTest extends AbstractOIDCTest {
- private InitializeOAuth2ClientAuthenticationContextHandler handler;
+ private InitializeOAuth2ClientAuthenticationMethodHandler handler;
@Override
@BeforeMethod
public void setup() throws Exception {
super.setup();
- handler = new InitializeOAuth2ClientAuthenticationContextHandler();
+ handler = new InitializeOAuth2ClientAuthenticationMethodHandler();
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list