[java-idp-oidc] branch main updated: JOIDC-171 - Support unregistered client policies in userinfo/token/introspection/revocation
Henri Mikkonen
henri.mikkonen at iki.fi
Tue Sep 5 18:50:25 UTC 2023
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=0337843d4795a2c07e0b046a8605ecf2b58e0433
The following commit(s) were added to refs/heads/main by this push:
new 0337843d JOIDC-171 - Support unregistered client policies in userinfo/token/introspection/revocation
0337843d is described below
commit 0337843d4795a2c07e0b046a8605ecf2b58e0433
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Tue Sep 5 21:49:49 2023 +0300
JOIDC-171 - Support unregistered client policies in userinfo/token/introspection/revocation
https://shibboleth.atlassian.net/browse/JOIDC-171
- Renamed beans/properties from *UnregisteredPolicy* to *UnregisteredClientPolicy*
- The default file exists at %{idp.home}/conf/oidc-unregistered-client-policy.json
- Example file provided by the distribution
- Wired the default policy to OIDC.UserInfo, OAUTH2.Introspection, OAUTH2.Revocation
- OIDC.SSO / OAUTH2.Token already wired by oidc-config module
- The test RP configs don't need to wire the lookup strategy anymore
- Also wired the default policy to the MDDriven configurations
---
.../META-INF/net.shibboleth.idp/postconfig.xml | 34 +++++++++++-----------
.../idp/service/relying-party/postconfig.xml | 29 ++++++++++++++++--
.../op/conf/oidc-unregistered-client-policy.json | 14 +++++++++
.../idp/plugin/oidc/op/conf/oidc.properties | 5 ++++
.../idp/plugin/oidc/op/module.properties | 3 ++
.../net/shibboleth/idp/module/conf/oidc.properties | 2 +-
.../shibboleth/idp/module/conf/relying-party.xml | 10 +++----
7 files changed, 71 insertions(+), 26 deletions(-)
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 5bbf1a48..c7eae656 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -690,24 +690,24 @@
</property>
</bean>
- <bean id="shibboleth.oidc.DefaultUnregisteredPolicyFilename" class="java.lang.String" factory-method="valueOf">
- <constructor-arg value="%{idp.oidc.DefaultUnregisteredPolicyFile:}" />
+ <bean id="shibboleth.oidc.DefaultUnregisteredClientPolicyFilename" class="java.lang.String" factory-method="valueOf">
+ <constructor-arg value="%{idp.oidc.DefaultUnregisteredClientPolicyFile:%{idp.home}/conf/oidc-unregistered-client-policy.json}" />
</bean>
- <bean id="shibboleth.oidc.DefaultUnregisteredPolicyLookupStrategy"
- parent="shibboleth.oidc.UnregisteredPolicyLookupStrategy"
- c:resource-ref="shibboleth.oidc.DefaultUnregisteredPolicyFilename"
- c:id="DefaultUnregisteredPolicyCache" />
+ <bean id="shibboleth.oidc.DefaultUnregisteredClientPolicyLookupStrategy"
+ parent="shibboleth.oidc.UnregisteredClientPolicyLookupStrategy"
+ c:resource-ref="shibboleth.oidc.DefaultUnregisteredClientPolicyFilename"
+ c:id="DefaultUnregisteredClientPolicyCache" />
<bean id="shibboleth.oidc.UnregisteredBatchMetadataCacheBuilderSpec"
class="net.shibboleth.oidc.metadata.cache.impl.BatchMetadataCacheBuilderSpec"
p:parsingStrategy-ref="shibboleth.oidc.UnregisteredDefaultJSONMapParsingStrategy"
p:criteriaToIdentifierStrategy-ref="shibboleth.oidc.UnregisteredDefaultMetadataCriteriaToIdentifierStrategy"
p:sourceMetadataExpiryStrategy-ref="shibboleth.oidc.UnregisteredDefaultExpirationTimeStrategy"
- p:identifierExtractionStrategy-ref="shibboleth.oidc.DefaultUnregisteredPolicyIdentifierExtractionStrategy"
- p:metadataValidPredicate-ref="shibboleth.oidc.DefaultUnregisteredPolicyValidator"/>
+ p:identifierExtractionStrategy-ref="shibboleth.oidc.DefaultUnregisteredClientPolicyIdentifierExtractionStrategy"
+ p:metadataValidPredicate-ref="shibboleth.oidc.DefaultUnregisteredClientPolicyValidator"/>
- <bean id="shibboleth.oidc.DefaultUnregisteredPolicyValidator"
+ <bean id="shibboleth.oidc.DefaultUnregisteredClientPolicyValidator"
class="net.shibboleth.idp.plugin.oidc.op.profile.logic.DefaultUnregisteredClientPolicyValidator" />
<bean id="shibboleth.oidc.UnregisteredDefaultJSONMapParsingStrategy"
@@ -715,25 +715,25 @@
c:valueClass="net.shibboleth.oidc.metadata.policy.MetadataPolicy"/>
<bean id="shibboleth.oidc.UnregisteredDefaultMetadataCriteriaToIdentifierStrategy"
- parent="shibboleth.Functions.Constant" c:target="#{getObject('shibboleth.oidc.DefaultUnregisteredPolicyFilename') ?: 'undefined'}" />
+ parent="shibboleth.Functions.Constant" c:target="#{getObject('shibboleth.oidc.DefaultUnregisteredClientPolicyFilename') ?: 'undefined'}" />
<bean id="shibboleth.oidc.UnregisteredDefaultExpirationTimeStrategy"
class="net.shibboleth.oidc.metadata.cache.impl.DefaultSourceMetadataExpirationTimeStrategy" c:duration="PT10M"/>
- <bean id="shibboleth.oidc.DefaultUnregisteredPolicyIdentifierExtractionStrategy"
- parent="shibboleth.Functions.Constant" c:target="#{getObject('shibboleth.oidc.DefaultUnregisteredPolicyFilename') ?: 'undefined'}" />
+ <bean id="shibboleth.oidc.DefaultUnregisteredClientPolicyIdentifierExtractionStrategy"
+ parent="shibboleth.Functions.Constant" c:target="#{getObject('shibboleth.oidc.DefaultUnregisteredClientPolicyFilename') ?: 'undefined'}" />
- <bean id="shibboleth.oidc.UnregisteredPolicyLookupStrategyFactory"
+ <bean id="shibboleth.oidc.UnregisteredClientPolicyLookupStrategyFactory"
class="net.shibboleth.oidc.metadata.cache.impl.MetadataPolicyLookupStrategyFactory" />
- <bean id="shibboleth.oidc.UnregisteredPolicyLookupStrategy" abstract="true"
- factory-bean="shibboleth.oidc.UnregisteredPolicyLookupStrategyFactory"
+ <bean id="shibboleth.oidc.UnregisteredClientPolicyLookupStrategy" abstract="true"
+ factory-bean="shibboleth.oidc.UnregisteredClientPolicyLookupStrategyFactory"
factory-method="buildFileLoadingMetadataPolicyResolver"
c:cacheSpec-ref="shibboleth.oidc.UnregisteredBatchMetadataCacheBuilderSpec"
c:criteriaSetLookupStrategy="#{null}"/>
- <bean id="shibboleth.oidc.DefaultUnregisteredPolicy"
- factory-bean="shibboleth.oidc.DefaultUnregisteredPolicyLookupStrategy"
+ <bean id="shibboleth.oidc.DefaultUnregisteredClientPolicy"
+ factory-bean="shibboleth.oidc.DefaultUnregisteredClientPolicyLookupStrategy"
factory-method="apply" c:_0="#{null}">
<!-- PRC given to the apply-method can be null as the default function doesn't exploit that -->
</bean>
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index 60eb1ac2..9af59cb9 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -25,7 +25,8 @@
p:issuer-ref="shibboleth.oidc.issuer"
p:encryptionOptional="%{idp.oidc.encryptionOptional:true}"
p:deniedUserInfoAttributes="%{idp.oidc.deniedUserInfoAttributes:}"
- p:issuedClaimsValidator-ref="DefaultUserInfoJWTClaimsValidator" />
+ p:issuedClaimsValidator-ref="DefaultUserInfoJWTClaimsValidator"
+ p:unregisteredClientPolicy="#{getObject('shibboleth.oidc.DefaultUnregisteredClientPolicy')}" />
<bean id="OIDC.Registration" parent="AbstractOIDCProfile" lazy-init="true"
class="net.shibboleth.oidc.profile.config.impl.DefaultOIDCDynamicRegistrationConfiguration"
@@ -58,7 +59,8 @@
p:issuer-ref="shibboleth.oidc.issuer"
p:tokenEndpointAuthMethods="%{idp.oidc.dynreg.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}"
p:claimsValidator-ref="DefaultJWTClaimsValidator"
- p:issuedClaimsValidator-ref="DefaultIntrospectionJWTClaimsValidator" />
+ p:issuedClaimsValidator-ref="DefaultIntrospectionJWTClaimsValidator"
+ p:unregisteredClientPolicy="#{getObject('shibboleth.oidc.DefaultUnregisteredClientPolicy')}" />
<bean id="OAUTH2.Revocation" parent="AbstractOIDCProfile" lazy-init="true"
class="net.shibboleth.oidc.profile.oauth2.config.impl.DefaultOAuth2TokenRevocationConfiguration"
@@ -67,7 +69,8 @@
p:claimsValidator-ref="DefaultJWTClaimsValidator"
p:issuedClaimsValidator-ref="DefaultRevocationJWTClaimsValidator"
p:revocationMethod="%{idp.oauth2.revocationMethod:CHAIN}"
- p:revocationLifetime="%{idp.oidc.revocationCache.authorizeCode.lifetime:PT6H}"/>
+ p:revocationLifetime="%{idp.oidc.revocationCache.authorizeCode.lifetime:PT6H}"
+ p:unregisteredClientPolicy="#{getObject('shibboleth.oidc.DefaultUnregisteredClientPolicy')}" />
<!-- Metadata-driven variants. -->
@@ -227,6 +230,11 @@
<bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="accessTokenClaimsSetManipulationStrategy"
p:propertyType="#{T(java.util.function.BiFunction)}" />
</property>
+ <property name="unregisteredClientPolicyLookupStrategy">
+ <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="unregisteredClientPolicy"
+ p:propertyType="#{T(java.util.function.Function)}"
+ p:defaultValue-ref="shibboleth.oidc.DefaultUnregisteredClientPolicy" />
+ </property>
</bean>
<bean id="OIDC.SSO.MDDriven" parent="AbstractMDDrivenOIDCSSOProfile" lazy-init="true"
@@ -360,6 +368,11 @@
p:propertyType="#{T(net.shibboleth.oidc.jwt.claims.ClaimsValidator)}"
p:defaultValue-ref="DefaultUserInfoJWTClaimsValidator" />
</property>
+ <property name="unregisteredClientPolicyLookupStrategy">
+ <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="unregisteredClientPolicy"
+ p:propertyType="#{T(java.util.function.Function)}"
+ p:defaultValue-ref="shibboleth.oidc.DefaultUnregisteredClientPolicy" />
+ </property>
</bean>
<bean id="OIDC.Registration.MDDriven" parent="AbstractMDDrivenOIDCFlowAwareProfile" lazy-init="true"
@@ -502,6 +515,11 @@
p:propertyType="#{T(net.shibboleth.oidc.jwt.claims.ClaimsValidator)}"
p:defaultValue-ref="DefaultIntrospectionJWTClaimsValidator" />
</property>
+ <property name="unregisteredClientPolicyLookupStrategy">
+ <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="unregisteredClientPolicy"
+ p:propertyType="#{T(java.util.function.Function)}"
+ p:defaultValue-ref="shibboleth.oidc.DefaultUnregisteredClientPolicy" />
+ </property>
</bean>
<bean id="OAUTH2.Revocation.MDDriven" parent="AbstractMDDrivenOAuthTokenValidatingProfile" lazy-init="true"
@@ -529,6 +547,11 @@
<bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="revocationLifetime"
p:defaultValue="%{idp.oidc.revocationCache.authorizeCode.lifetime:PT6H}" />
</property>
+ <property name="unregisteredClientPolicyLookupStrategy">
+ <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="unregisteredClientPolicy"
+ p:propertyType="#{T(java.util.function.Function)}"
+ p:defaultValue-ref="shibboleth.oidc.DefaultUnregisteredClientPolicy" />
+ </property>
</bean>
<!-- Default client-auth JWT validation wiring. -->
diff --git a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc-unregistered-client-policy.json b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc-unregistered-client-policy.json
new file mode 100644
index 00000000..9e04402d
--- /dev/null
+++ b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc-unregistered-client-policy.json
@@ -0,0 +1,14 @@
+{
+ "client_id": {
+ "one_of": ["policyAcceptedClientID1", "policyAcceptedClientID2"]
+ },
+ "scope": {
+ "value": "openid"
+ },
+ "redirect_uri": {
+ "regexp": "^https:\/\/(?:([^.]+).)?example.org\/(.*)"
+ },
+ "response_type": {
+ "one_of": ["code"]
+ }
+}
diff --git a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
index ba5f553b..e9441cba 100644
--- a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
+++ b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
@@ -66,6 +66,11 @@ idp.signing.oidc.rsa.enc.key = %{idp.home}/credentials/idp-encryption-rsa.jwk
# Store user consent to authorization code & access/refresh tokens instead of exploiting consent storage
#idp.oidc.encodeConsentInTokens = false
+# The location for the policy JSON file for unregistered clients (when no client metadata is registered
+# and shibboleth.UnverifiedRelyingParty is enabled
+# Related to OIDC.SSO, OAUTH2.Token, OIDC.UserInfo, OAUTH2.Introspection, OAUTH2.Revocation configurations
+#idp.oidc.DefaultUnregisteredClientPolicyFile = %{idp.home}/conf/oidc-unregistered-client-policy.json
+
# shibboleth.ClientInformationResolverService properties
#idp.service.clientinfo.failFast = false
#idp.service.clientinfo.checkInterval = PT0S
diff --git a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/module.properties b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/module.properties
index d1df16e3..577dc877 100644
--- a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/module.properties
+++ b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/module.properties
@@ -64,4 +64,7 @@ idp.oidc.OP.3.14.exec = true
idp.oidc.OP.3.15.src = /net/shibboleth/idp/plugin/oidc/op/bin/oidc-clients.bat
idp.oidc.OP.3.15.dest = bin/oidc-clients.bat
+idp.oidc.OP.3.16.src = /net/shibboleth/idp/plugin/oidc/op/conf/oidc-unregistered-client-policy.json
+idp.oidc.OP.3.16.dest = conf/oidc-unregistered-client-policy.json
+
idp.oidc.OP.3.postenable = See documentation for additional instructions to enable the OP module.
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/oidc.properties b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/oidc.properties
index b5d3ad2c..fca79757 100644
--- a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/oidc.properties
+++ b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/oidc.properties
@@ -20,4 +20,4 @@ idp.oauth2.defaultAllowedAudience = https://rp.example.org
idp.oidc.discovery.resolver.values = CustomConfigurationValues
-idp.oidc.DefaultUnregisteredPolicyFile = src/test/resources/net/shibboleth/idp/module/conf/unregistered-policy.json
\ No newline at end of file
+idp.oidc.DefaultUnregisteredClientPolicyFile = src/test/resources/net/shibboleth/idp/module/conf/unregistered-policy.json
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/relying-party.xml b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/relying-party.xml
index 7243f177..ec842bc6 100644
--- a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/relying-party.xml
+++ b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/relying-party.xml
@@ -39,12 +39,12 @@
<ref bean="OIDC.Keyset" />
<ref bean="OIDC.Registration" />
<ref bean="OIDC.Configuration" />
- <bean parent="OIDC.SSO" p:unregisteredClientPolicyLookupStrategy-ref="shibboleth.oidc.DefaultUnregisteredPolicyLookupStrategy"/>
- <bean parent="OAUTH2.Token" p:unregisteredClientPolicyLookupStrategy-ref="shibboleth.oidc.DefaultUnregisteredPolicyLookupStrategy"/>
+ <bean parent="OIDC.SSO" />
+ <bean parent="OAUTH2.Token" />
<bean parent="OAUTH2.TokenAudience" p:encryptionOptional="true" />
- <bean parent="OIDC.UserInfo" p:unregisteredClientPolicyLookupStrategy-ref="shibboleth.oidc.DefaultUnregisteredPolicyLookupStrategy"/>
- <bean parent="OAUTH2.Introspection" p:unregisteredClientPolicyLookupStrategy-ref="shibboleth.oidc.DefaultUnregisteredPolicyLookupStrategy"/>
- <bean parent="OAUTH2.Revocation" p:unregisteredClientPolicyLookupStrategy-ref="shibboleth.oidc.DefaultUnregisteredPolicyLookupStrategy"/>
+ <bean parent="OIDC.UserInfo" />
+ <bean parent="OAUTH2.Introspection" />
+ <bean parent="OAUTH2.Revocation" />
</list>
</property>
</bean>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list