[java-idp-oidc] branch main updated: JOIDC-200 - Support for OAuth2 Pushed Authorization Requests (PAR)

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=b84e4cb5dc1b8594b9c97e83373312531c188263

The following commit(s) were added to refs/heads/main by this push:
     new b84e4cb5 JOIDC-200 - Support for OAuth2 Pushed Authorization Requests (PAR)
b84e4cb5 is described below

commit b84e4cb5dc1b8594b9c97e83373312531c188263
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Jul 5 12:11:41 2024 +0300

    JOIDC-200 - Support for OAuth2 Pushed Authorization Requests (PAR)
    
    https://shibboleth.atlassian.net/browse/JOIDC-200
    
    - Add WARN-log line if the request_uri value exceeds 512 ASCII characters.
    - Wired global properties idp.oauth2.par.requestUriType and idp.oauth2.par.requestUriLifetime.
---
 .../impl/FormOutbounPushedAuthorizationResponseMessage.java  |  4 ++++
 .../net/shibboleth/idp/service/relying-party/postconfig.xml  | 12 +++++++++++-
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/FormOutbounPushedAuthorizationResponseMessage.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/FormOutbounPushedAuthorizationResponseMessage.java
index b2924e11..147a38dc 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/FormOutbounPushedAuthorizationResponseMessage.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/FormOutbounPushedAuthorizationResponseMessage.java
@@ -154,6 +154,10 @@ public class FormOutbounPushedAuthorizationResponseMessage extends AbstractOAuth
             return;
         }
 
+        if (serializedUri.toASCIIString().length() > 512) {
+            log.warn("{} The serialized URI value length exceeds 512 ASCII characters", getLogPrefix());
+        }
+
         assert requestUriLifetime != null;
         long lifetime = requestUriLifetime.getSeconds();
 
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index 9b5d9e44..4f8bfe96 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -98,7 +98,9 @@
         p:tokenEndpointAuthMethods="%{idp.oidc.par.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}"
         p:claimsValidator-ref="DefaultJWTClaimsValidator"
         p:dpopProofClaimsValidator-ref="DefaultDPoPProofClaimsValidator"
-        p:unregisteredClientPolicy="#{getObject('shibboleth.oidc.DefaultUnregisteredClientPolicy')}"/>
+        p:unregisteredClientPolicy="#{getObject('shibboleth.oidc.DefaultUnregisteredClientPolicy')}"
+        p:requestUriType="%{idp.oauth2.par.requestUriType:}"
+        p:requestUriLifetime="%{idp.oauth2.par.requestUriLifetime:PT1M}"/>
 
     <bean id="DefaultLogoutHintMatchingPredicate"
           class="net.shibboleth.idp.plugin.oidc.op.profile.logic.DefaultLogoutHintMatchingPredicate"/>
@@ -730,6 +732,14 @@
                 p:propertyType="#{T(net.shibboleth.oidc.security.jose.SignatureValidationConfiguration)}"
                 p:defaultValue-ref="DPoPSignatureValidationConfiguration" />
         </property>
+        <property name="requestUriTypeLookupStrategy">
+            <bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="requestUriType"
+                p:defaultValue="%{idp.oauth2.par.requestUriType:}" />
+        </property>
+        <property name="requestUriLifetimeLookupStrategy">
+            <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="requestUriLifetime"
+                p:defaultValue="%{idp.oauth2.par.requestUriLifetime:PT1M}" />
+        </property>
     </bean>
 
     <!-- Default client-auth JWT validation wiring. -->

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.