[java-idp-plugin-oidc-rp] branch main updated: Cleanup beans xml
Phil Smart
philip.smart at jisc.ac.uk
Fri May 5 10:38:24 UTC 2023
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=c933261ea6c1d302943598ea09d0a6342e0ef17d
The following commit(s) were added to refs/heads/main by this push:
new c933261 Cleanup beans xml
c933261 is described below
commit c933261ea6c1d302943598ea09d0a6342e0ef17d
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri May 5 11:38:22 2023 +0100
Cleanup beans xml
---
.../oidc-relying-party-authn-beans.xml | 63 ++++++++++++----------
1 file changed, 34 insertions(+), 29 deletions(-)
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
index afeb02b..93b5970 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
@@ -153,24 +153,23 @@
p:useDefaultTimeZone="#{getObject('shibboleth.AuditDefaultTimeZone') ?: false}"
p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier" />
- <bean id="RequestObjectRequiredAndSupportedPredicate"
+ <bean id="RequestObjectRequiredAndSupportedPredicate" scope="prototype"
class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic.RequestObjectRequiredAndSupported" />
- <bean id="SignRequestObjectProxyCondition"
- class="net.shibboleth.oidc.profile.config.logic.SignRequestObjectPredicate"
- p:relyingPartyContextLookupStrategy-ref="shibboleth.ChildLookup.Proxy.RelyingPartyContext" />
-
- <bean id="EncryptRequestObjectCondition"
- class="net.shibboleth.oidc.profile.config.logic.EncryptRequestObjectPredicate"
- p:relyingPartyContextLookupStrategy-ref="shibboleth.ChildLookup.RelyingParty" />
+
<bean id="PopulateRequestObjectSignatureSigningParameters" scope="prototype"
class="net.shibboleth.oidc.profile.impl.PopulateJWTSignatureSigningParameters"
c:strategy-ref="shibboleth.ChildLookup.Proxy.MessageContextLookup.Inbound" p:noResultIsError="true"
p:configurationLookupStrategy-ref="RequestObjectSignatureSigningConfigurationLookup"
p:providerMetadataContextLookupStrategy-ref="shibboleth.ChildLookup.OIDCProviderMetadataContextFromOutbound"
- p:signatureSigningParametersResolver-ref="RequestObjectSignatureSigningParametersResolver"
- p:activationCondition-ref="SignRequestObjectProxyCondition" />
+ p:signatureSigningParametersResolver-ref="RequestObjectSignatureSigningParametersResolver">
+ <property name="activationCondition">
+ <bean id="SignRequestObjectProxyCondition"
+ class="net.shibboleth.oidc.profile.config.logic.SignRequestObjectPredicate"
+ p:relyingPartyContextLookupStrategy-ref="shibboleth.ChildLookup.Proxy.RelyingPartyContext" />
+ </property>
+ </bean>
<bean id="RequestObjectSignatureSigningParametersResolver" scope="prototype"
class="net.shibboleth.oidc.security.jose.impl.RelyingPartySigningParametersResolver"
@@ -179,7 +178,7 @@
<bean id="RequestObjectSupportedSignatureSigningAlgorithms" scope="prototype"
class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.navigate.RequestObjectSupportedSignatureSigningAlgorithms" />
- <bean id="RequestObjectSignatureSigningConfigurationLookup" lazy-init="true"
+ <bean id="RequestObjectSignatureSigningConfigurationLookup" lazy-init="true" scope="prototype"
class="net.shibboleth.oidc.profile.config.navigate.JWTSignatureSigningConfigurationLookupFunction"
p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
@@ -191,10 +190,16 @@
p:configurationLookupStrategy-ref="RequestObjectEncryptionConfigurationLookup"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
p:providerMetadataContextLookupStrategy-ref="shibboleth.ChildLookup.OIDCProviderMetadataContextFromOutbound"
- p:encryptionParametersResolver-ref="EncryptionParametersResolver"
- p:activationCondition-ref="EncryptRequestObjectCondition" />
+ p:encryptionParametersResolver-ref="EncryptionParametersResolver">
+ <property name="activationCondition">
+ <bean id="EncryptRequestObjectCondition"
+ class="net.shibboleth.oidc.profile.config.logic.EncryptRequestObjectPredicate"
+ p:relyingPartyContextLookupStrategy-ref="shibboleth.ChildLookup.RelyingParty" />
+ </property>
+
+ </bean>
- <bean id="RequestObjectEncryptionConfigurationLookup" lazy-init="true"
+ <bean id="RequestObjectEncryptionConfigurationLookup" lazy-init="true" scope="prototype"
class="net.shibboleth.oidc.profile.config.navigate.JWTEncryptionConfigurationLookupFunction"
p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
@@ -227,7 +232,7 @@
p:claimsSetIsValidPredicate="#{getObject('shibboleth.authn.oidc.rp.RequestObjectClaimsSetIsValidPredicate')}"
p:requestObjectToBeSignedPredicate-ref="SignRequestObjectCondition" />
- <bean id="SignRequestObjectCondition"
+ <bean id="SignRequestObjectCondition" scope="prototype"
class="net.shibboleth.oidc.profile.config.logic.SignRequestObjectPredicate"
p:relyingPartyContextLookupStrategy-ref="shibboleth.ChildLookup.RelyingParty" />
@@ -297,7 +302,7 @@
</property>
</bean>
- <bean id="DefaultRedirectUriCreationStrategy"
+ <bean id="DefaultRedirectUriCreationStrategy" scope="prototype"
p:callbackServletPath="#{getObject('shibboleth.authn.OIDC.externalServletPath')}/callback"
p:allowedOrigins="%{idp.oidc.rp.client.redirecturl.allowedOrigins:}"
class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.DefaultRedirectUriCreationFunction" />
@@ -394,7 +399,7 @@
<bean id="JWTDecryptionParametersResolver" scope="prototype"
class="net.shibboleth.oidc.security.jose.impl.DefaultDecryptionParametersResolver" />
- <bean id="IDTokenDecryptionConfigurationLookup" lazy-init="true"
+ <bean id="IDTokenDecryptionConfigurationLookup" lazy-init="true" scope="prototype"
class="net.shibboleth.oidc.profile.config.navigate.JWTDecryptionConfigurationLookupFunction"
p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
@@ -544,7 +549,7 @@
</property>
</bean>
- <bean id="IssuerIDFromOIDCProviderMetadataContextLookupFunction"
+ <bean id="IssuerIDFromOIDCProviderMetadataContextLookupFunction" scope="prototype"
class="net.shibboleth.oidc.profile.logic.IssuerIDFromOIDCProviderMetadataContextLookupFunction"
p:oIDCMetadataContextLookupStrategy-ref="OIDCProviderMetadataContextFromOutboundPeerLookupStrategy" />
@@ -605,7 +610,7 @@
p:activationCondition="#{getObject('shibboleth.authn.oidc.rp.jwt.AuthTimeActivationCondition') ?:
getObject('DefaultAuthTimeActivationCondition')}"/>
- <bean id="MaxAgeLookupFunction"
+ <bean id="MaxAgeLookupFunction" scope="prototype"
class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.MaxAgeLookupFunction"
c:maxAgeDefault="%{idp.oidc.rp.client.idtoken.jwt.verifier.authnLifetime:PT60S}"/>
@@ -650,18 +655,18 @@
<!-- UserInfo decryption and signature check if JWT type -->
- <!-- FIXME: (might not be an issue) Will populate the same security params context as the id_token, but overwrite the
- decryption config. The SAML one uses the same context for signature and decryption, so this seems OK? -->
+ <!-- Will populate the same security params context as the id_token, but overwrite the decryption config. -->
<bean id="PopulateUserInfoDecryptionParameters"
class="net.shibboleth.oidc.profile.impl.PopulateJWTDecryptionParameters" scope="prototype"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
- p:configurationLookupStrategy-ref="UserInfoTokenDecryptionConfigurationLookup"
- p:decryptionParametersResolver-ref="JWTDecryptionParametersResolver" />
-
- <bean id="UserInfoTokenDecryptionConfigurationLookup" lazy-init="true"
- class="net.shibboleth.oidc.profile.config.navigate.JWTDecryptionConfigurationLookupFunction"
- p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
-
+ p:decryptionParametersResolver-ref="JWTDecryptionParametersResolver">
+ <property name="configurationLookupStrategy">
+ <bean id="UserInfoTokenDecryptionConfigurationLookup" scope="prototype"
+ class="net.shibboleth.oidc.profile.config.navigate.JWTDecryptionConfigurationLookupFunction"
+ p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
+ </property>
+ </bean>
+
<bean id="DecryptUserInfoJWE" class="net.shibboleth.oidc.security.impl.DecryptJWE" scope="prototype"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext">
<property name="jwtTokenLookupStrategy">
@@ -827,7 +832,7 @@
<ref bean="c14n/OIDCSubjectIdentifier" />
</util:list>
- <bean id="UnsupportedResponseTypeAction"
+ <bean id="UnsupportedResponseTypeAction" scope="prototype"
class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.UnsupportedResponseTypeAction" />
<!--
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list