[java-idp-oidc] branch main updated: JOIDC-13 - Support for OIDC Logout

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=9cf74672b0111d9fed379b5b4bad750866af3b74

The following commit(s) were added to refs/heads/main by this push:
     new 9cf74672 JOIDC-13 - Support for OIDC Logout
9cf74672 is described below

commit 9cf74672b0111d9fed379b5b4bad750866af3b74
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Mar 22 15:09:06 2024 +0200

    JOIDC-13 - Support for OIDC Logout
    
    https://shibboleth.atlassian.net/browse/JOIDC-13
    
    Wired the properties to OIDC.Logout and OIDC.Logout.MDDriven.
---
 .../idp/service/relying-party/postconfig.xml       | 54 ++++++++++++++++++++--
 .../idp/plugin/oidc/op/conf/oidc.properties        | 20 ++++++++
 2 files changed, 71 insertions(+), 3 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index c5a1c038..eb6b777f 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -76,8 +76,12 @@
           class="net.shibboleth.oidc.profile.config.impl.DefaultOIDCLogoutConfiguration"
           p:issuer-ref="shibboleth.oidc.issuer"
           p:logoutHintMatchingStrategy-ref="%{idp.oidc.logout.logoutHintMatchingStrategy:DefaultLogoutHintMatchingPredicate}"
-          p:securityConfiguration-ref="%{idp.security.oidc.logout.config:shibboleth.oidc.logout.DefaultSecurityConfiguration}" />
-        <!-- TODO: default values via configuration properties once the set is final -->
+          p:securityConfiguration-ref="%{idp.security.oidc.logout.config:shibboleth.oidc.logout.DefaultSecurityConfiguration}"
+          p:preferFrontChannel="%{idp.oidc.logout.preferFrontChannel:true}"
+          p:frontChannelSuccess="%{idp.oidc.logout.frontChannelSuccess:false}"
+          p:revokeTokens="%{idp.oidc.logout.revokeTokens:true}"
+          p:requireIdTokenHint="%{idp.oidc.logout.requireIdTokenHint:true}"
+          p:encryptionOptional="%{idp.oidc.logout.encryptionOptional:true}"/>
 
     <bean id="DefaultLogoutHintMatchingPredicate"
           class="net.shibboleth.idp.plugin.oidc.op.profile.logic.DefaultLogoutHintMatchingPredicate"/>
@@ -572,7 +576,51 @@
             <bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="issuer"
                   p:defaultValue-ref="shibboleth.oidc.issuer"/>
         </property>
-        <!-- TODO: wire other properties with their default values via conf properties once the set is final -->
+        <property name="encryptionOptionalPredicate">
+            <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+                <constructor-arg>
+                    <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="encryptionOptional" />
+                </constructor-arg>
+                <constructor-arg value="%{idp.oidc.logout.encryptionOptional:true}" />
+            </bean>
+        </property>
+        <property name="preferFrontChannelPredicate">
+            <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+                <constructor-arg>
+                    <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="preferFrontChannel" />
+                </constructor-arg>
+                <constructor-arg value="%{idp.oidc.logout.preferFrontChannel:true}" />
+            </bean>
+        </property>
+        <property name="frontChannelSuccessPredicate">
+            <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+                <constructor-arg>
+                    <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="frontChannelSuccess" />
+                </constructor-arg>
+                <constructor-arg value="%{idp.oidc.logout.frontChannelSuccess:false}" />
+            </bean>
+        </property>
+        <property name="revokeTokensPredicate">
+            <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+                <constructor-arg>
+                    <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="revokeTokens" />
+                </constructor-arg>
+                <constructor-arg value="%{idp.oidc.logout.revokeTokens:true}" />
+            </bean>
+        </property>
+        <property name="requireIdTokenHintPredicate">
+            <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+                <constructor-arg>
+                    <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="requireIdTokenHint" />
+                </constructor-arg>
+                <constructor-arg value="%{idp.oidc.logout.requireIdTokenHint:true}" />
+            </bean>
+        </property>
+        <property name="logoutHintMatchingStrategyLookupStrategy">
+            <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="logoutHintMatchingStrategy"
+                p:propertyType="#{T(java.util.function.BiPredicate)}"
+                p:defaultValue-ref="%{idp.oidc.logout.logoutHintMatchingStrategy:DefaultLogoutHintMatchingPredicate}" />
+        </property>
     </bean>
 
     <!-- Default client-auth JWT validation wiring. -->
diff --git a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
index cb7e822e..4657b3ce 100644
--- a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
+++ b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
@@ -123,6 +123,26 @@ idp.oidc.subject.salt = this_too_should_be_ch4ng3d
 # ObjectMapper bean used for pretty-printing JSON in rotocol messages. Defaults to shibboleth.oidc.JSONObjectMapper
 #idp.oidc.logging.objectMapper = shibboleth.oidc.JSONObjectMapper
 
+# Settings related to OIDC logout functionality
+
+# Whether to automatically disable back-channel logout token encryption if the relying party does not possess a suitable key (defaults to true).
+#idp.oidc.logout.encryptionOptional = true
+
+# Whether to prefer front-channel logout propagation if both front and back -channel URIs are defined in the RP metadata (defaults to true).
+#idp.oidc.logout.preferFrontChannel = true
+
+# Whether to consider front-channel logout propagation success in the propagation UI (defaults to false).
+#idp.oidc.logout.frontChannelSuccess = false
+
+# Whether to revoke the access and refresh tokens related to the session (defaults to true). Note that the OAUTH2.Revocation profile must be enabled for the RP.
+#idp.oidc.logout.revokeTokens = true
+
+# Whether to require the use of id_token_hint parameter in the RP-initiated logout request.
+#idp.oidc.logout.requireIdTokenHint = true
+
+# Bean (BiPredicate<String,SPSession>) used for matching logout hint to the SP session
+#idp.oidc.logout.logoutHintMatchingStrategy = 
+
 # Settings for issue-registration-access-token flow
 #idp.oidc.admin.registration.logging = IssueRegistrationAccessToken
 #idp.oidc.admin.registration.nonBrowserSupported = true

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.