[java-idp-oidc] branch main updated: JOIDC-211 - Provide method to customise response message contents
Henri Mikkonen
henri.mikkonen at iki.fi
Fri May 24 06:36:16 UTC 2024
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=35524587c63cba18f36e4555c006c4944c24b91e
The following commit(s) were added to refs/heads/main by this push:
new 35524587 JOIDC-211 - Provide method to customise response message contents
35524587 is described below
commit 35524587c63cba18f36e4555c006c4944c24b91e
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri May 24 09:35:32 2024 +0300
JOIDC-211 - Provide method to customise response message contents
https://shibboleth.atlassian.net/browse/JOIDC-211
- Wired a new CallInboundMessageHandler right after DecodeMessage to call messageHandler if set in profile configuration.
- Moved 'DecodeMessage' state into abstract flow. Default transition is to 'DoMetadataLookup' but it can be overridden via 'transitionAfterDecode' flowScope variable.
- Wired 'messageHandler' to MDDriven configs
---
.../oauth2/introspection/introspection-flow.xml | 11 +--------
.../pushed-authorization-flow.xml | 13 ++---------
.../flows/oauth2/revocation/revocation-flow.xml | 13 +++--------
.../flows/oidc/abstract/oidc-abstract-beans.xml | 27 ++++++++++++++--------
.../idp/flows/oidc/abstract/oidc-abstract-flow.xml | 11 +++++++++
.../idp/flows/oidc/authorize/authorize-flow.xml | 10 +++++---
.../flows/oidc/end-session/end-session-flow.xml | 8 -------
.../idp/flows/oidc/register/register-flow.xml | 8 +++----
.../shibboleth/idp/flows/oidc/token/token-flow.xml | 11 +--------
.../idp/flows/oidc/userinfo/userinfo-flow.xml | 8 +++----
.../idp/service/relying-party/postconfig.xml | 4 ++++
11 files changed, 55 insertions(+), 69 deletions(-)
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/introspection/introspection-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/introspection/introspection-flow.xml
index 572bc538..ec9ff53b 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/introspection/introspection-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/introspection/introspection-flow.xml
@@ -10,16 +10,7 @@
<evaluate expression="InitializeOutboundMessageContext" />
<evaluate expression="'proceed'" />
- <transition on="proceed" to="DecodeMessage" />
- </action-state>
-
- <action-state id="DecodeMessage">
- <evaluate expression="DecodeMessage" />
- <evaluate expression="PostDecodePopulateAuditContext" />
- <evaluate expression="'proceed'" />
-
- <!-- DoMetadataLookup is expected to proceed to SelectConfiguration -->
- <transition on="proceed" to="DoMetadataLookup" />
+ <transition on="proceed" to="DecodeMessage"/>
</action-state>
<action-state id="SelectConfiguration">
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/pushed-authorization/pushed-authorization-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/pushed-authorization/pushed-authorization-flow.xml
index 04327da2..e941791d 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/pushed-authorization/pushed-authorization-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/pushed-authorization/pushed-authorization-flow.xml
@@ -10,17 +10,8 @@
<evaluate expression="InitializeOutboundMessageContext" />
<evaluate expression="'proceed'" />
- <transition on="proceed" to="DecodeMessage" />
- </action-state>
-
- <action-state id="DecodeMessage">
- <evaluate expression="DecodeMessage" />
- <evaluate expression="PostDecodePopulateAuditContext" />
- <evaluate expression="'proceed'" />
-
- <!-- DoMetadataLookup is expected to proceed to SelectConfiguration -->
- <transition on="proceed" to="DoMetadataLookup" />
- </action-state>
+ <transition on="proceed" to="DecodeMessage"/>
+ </action-state>
<action-state id="SelectConfiguration">
<evaluate expression="SelectRelyingPartyConfiguration" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/revocation/revocation-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/revocation/revocation-flow.xml
index 55864840..3e0f6f0f 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/revocation/revocation-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/revocation/revocation-flow.xml
@@ -10,16 +10,9 @@
<evaluate expression="InitializeOutboundMessageContext" />
<evaluate expression="'proceed'" />
- <transition on="proceed" to="DecodeMessage" />
- </action-state>
-
- <action-state id="DecodeMessage">
- <evaluate expression="DecodeMessage" />
- <evaluate expression="PostDecodePopulateAuditContext" />
- <evaluate expression="'proceed'" />
-
- <!-- DoMetadataLookup is expected to proceed to SelectConfiguration -->
- <transition on="proceed" to="DoMetadataLookup" />
+ <transition on="proceed" to="DecodeMessage">
+ <set name="flowScope.transitionAfterDecode" value="'DoMetadataLookup'" />
+ </transition>
</action-state>
<action-state id="SelectConfiguration">
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml
index 837e2465..af5f5bf7 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml
@@ -13,6 +13,21 @@
p:legacyProfileId="#{getObject('shibboleth.oidc.legacyProfileId')}"
p:loggingId-ref="shibboleth.oidc.loggingId"
p:browserProfile-ref="shibboleth.oidc.browserProfile" />
+
+ <bean id="CallInboundMessageHandler"
+ class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor" scope="prototype"
+ c:executionDirection="INBOUND">
+ <constructor-arg name="messageHandler">
+ <bean class="org.opensaml.messaging.handler.impl.FunctionMessageHandler" scope="prototype">
+ <property name="functionLookupStrategy">
+ <bean class="net.shibboleth.oidc.profile.config.navigate.MessageHandlerLookupFunction" />
+ </property>
+ </bean>
+ </constructor-arg>
+ <property name="errorEvent">
+ <util:constant static-field="org.opensaml.profile.action.EventIds.MESSAGE_PROC_ERROR" />
+ </property>
+ </bean>
<bean id="SelectRelyingPartyConfiguration"
class="net.shibboleth.idp.profile.impl.SelectRelyingPartyConfiguration" scope="prototype"
@@ -62,15 +77,9 @@
class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor" scope="prototype"
c:executionDirection="OUTBOUND">
<constructor-arg name="messageHandler">
- <bean class="org.opensaml.messaging.handler.impl.BasicMessageHandlerChain" scope="prototype">
- <property name="handlers">
- <list>
- <bean class="org.opensaml.messaging.handler.impl.FunctionMessageHandler" scope="prototype">
- <property name="functionLookupStrategy">
- <bean class="net.shibboleth.oidc.profile.config.navigate.MessageHandlerLookupFunction" />
- </property>
- </bean>
- </list>
+ <bean class="org.opensaml.messaging.handler.impl.FunctionMessageHandler" scope="prototype">
+ <property name="functionLookupStrategy">
+ <bean class="net.shibboleth.oidc.profile.config.navigate.MessageHandlerLookupFunction" />
</property>
</bean>
</constructor-arg>
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-flow.xml
index 93ffdf84..022d0a49 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-flow.xml
@@ -3,6 +3,17 @@
xsi:schemaLocation="http://www.springframework.org/schema/webflow http://www.springframework.org/schema/webflow/spring-webflow.xsd"
abstract="true">
+ <action-state id="DecodeMessage">
+ <on-entry>
+ <evaluate expression="flowRequestContext.getFlowScope().get('transitionAfterDecode') != null ? flowRequestContext.getFlowScope().get('transitionAfterDecode') : 'DoMetadataLookup'" result="flowScope.transitionTarget"/>
+ </on-entry>
+ <evaluate expression="DecodeMessage" />
+ <evaluate expression="CallInboundMessageHandler" />
+ <evaluate expression="PostDecodePopulateAuditContext" />
+ <evaluate expression="'proceed'" />
+ <transition on="proceed" to="#{transitionTarget}" />
+ </action-state>
+
<action-state id="PopulateOutboundInterceptContext">
<evaluate expression="PopulateOutboundInterceptContext" />
<evaluate expression="'proceed'" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-flow.xml
index 954deb12..a103849b 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-flow.xml
@@ -19,14 +19,18 @@
<action-state id="DecodeOIDCMessage">
<evaluate expression="DecodeOIDCMessage" />
- <evaluate expression="PostDecodePopulateAuditContext" />
<evaluate expression="'proceed'" />
- <!-- DoMetadataLookup is expected to proceed to SelectConfiguration -->
- <transition on="proceed" to="DoMetadataLookup" />
+ <transition on="proceed" to="PostDecodeMessage" />
</action-state>
<action-state id="DecodeOAuthMessage">
<evaluate expression="DecodeOAuthMessage" />
+ <evaluate expression="'proceed'" />
+ <transition on="proceed" to="PostDecodeMessage" />
+ </action-state>
+
+ <action-state id="PostDecodeMessage">
+ <evaluate expression="CallInboundMessageHandler" />
<evaluate expression="PostDecodePopulateAuditContext" />
<evaluate expression="'proceed'" />
<!-- DoMetadataLookup is expected to proceed to SelectConfiguration -->
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/end-session/end-session-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/end-session/end-session-flow.xml
index da2fc539..67a8304e 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/end-session/end-session-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/end-session/end-session-flow.xml
@@ -18,14 +18,6 @@
then="RedirectToGenericLogout" else="DecodeMessage" />
</decision-state>
- <action-state id="DecodeMessage">
- <evaluate expression="DecodeMessage" />
- <evaluate expression="PostDecodePopulateAuditContext" />
- <evaluate expression="'proceed'" />
- <!-- DoMetadataLookup is expected to proceed to SelectConfiguration -->
- <transition on="proceed" to="DoMetadataLookup" />
- </action-state>
-
<action-state id="SelectConfiguration">
<evaluate expression="SelectRelyingPartyConfiguration" />
<evaluate expression="SelectProfileConfiguration" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/register/register-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/register/register-flow.xml
index 5edac98d..6059ca08 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/register/register-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/register/register-flow.xml
@@ -9,12 +9,12 @@
<evaluate expression="FlowStartPopulateAuditContext" />
<evaluate expression="InitializeOutboundMessageContext" />
<evaluate expression="'proceed'" />
- <transition on="proceed" to="DecodeMessage" />
+ <transition on="proceed" to="DecodeMessage">
+ <set name="flowScope.transitionAfterDecode" value="'PostDecodeMessage'" />
+ </transition>
</action-state>
- <action-state id="DecodeMessage">
- <evaluate expression="DecodeMessage" />
- <evaluate expression="PostDecodePopulateAuditContext" />
+ <action-state id="PostDecodeMessage">
<evaluate expression="InitializeRelyingPartyContext" />
<evaluate expression="ValidateRegistrationAccessToken" />
<evaluate expression="SelectRelyingPartyConfiguration" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-flow.xml
index c2c11bdd..99d778bc 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-flow.xml
@@ -9,16 +9,7 @@
<evaluate expression="InitializeOutboundMessageContext" />
<evaluate expression="'proceed'" />
- <transition on="proceed" to="DecodeMessage" />
- </action-state>
-
- <action-state id="DecodeMessage">
- <evaluate expression="DecodeMessage" />
- <evaluate expression="PostDecodePopulateAuditContext" />
- <evaluate expression="'proceed'" />
-
- <!-- DoMetadataLookup is expected to proceed to SelectConfiguration -->
- <transition on="proceed" to="DoMetadataLookup" />
+ <transition on="proceed" to="DecodeMessage"/>
</action-state>
<action-state id="SelectConfiguration">
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-flow.xml
index e180e7b9..8890f361 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-flow.xml
@@ -10,12 +10,12 @@
<evaluate expression="InitializeOutboundMessageContext" />
<evaluate expression="'proceed'" />
- <transition on="proceed" to="DecodeMessage" />
+ <transition on="proceed" to="DecodeMessage">
+ <set name="flowScope.transitionAfterDecode" value="'PostDecodeMessage'" />
+ </transition>
</action-state>
- <action-state id="DecodeMessage">
- <evaluate expression="DecodeMessage" />
- <evaluate expression="PostDecodePopulateAuditContext" />
+ <action-state id="PostDecodeMessage">
<evaluate expression="ParseAccessToken" />
<evaluate expression="'proceed'" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index ed8c3fc1..37727355 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -135,6 +135,10 @@
<bean parent="shibboleth.MDDrivenListProperty" p:propertyName="defaultAuthenticationMethods"
p:propertyType="#{T(net.shibboleth.oidc.authn.principal.AuthenticationContextClassReferencePrincipal)}" />
</property>
+ <property name="messageHandlerLookupStrategy">
+ <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="messageHandler"
+ p:propertyType="#{T(java.util.function.Function)}" />
+ </property>
</bean>
<bean id="AbstractMDDrivenOAuthTokenValidatingProfile" parent="AbstractMDDrivenOAuthClientAuthenticatableProfile" abstract="true">
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list