[java-idp-oidc] 02/35: JOIDC-201 - Support for OAuth 2.0 Demonstrating Proof of Possession (DPoP)

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch dev/JOIDC-222
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=9d84c9957fff33d1467de446dbb2ea55b5305d18

commit 9d84c9957fff33d1467de446dbb2ea55b5305d18
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Wed Sep 11 14:04:32 2024 +0300

    JOIDC-201 - Support for OAuth 2.0 Demonstrating Proof of Possession (DPoP)
    
    https://shibboleth.atlassian.net/browse/JOIDC-201
    
    - Apply the SHA256 hash for the long jti values
    - Removed obsolete 'IssuedAtClaimsValidator' as the claim is already handled by 'DPoPProofIssuedAtClaimsValidator'
---
 .../net/shibboleth/idp/service/relying-party/postconfig.xml        | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index 9f3363ec..35106003 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -1063,12 +1063,15 @@
             p:clockSkew="%{idp.policy.clockSkew:PT1M}"
             p:messageLifetime="%{idp.policy.messageLifetime:PT1M}"
             p:requiredRule="true" />
-        <ref bean="IssuedAtClaimsValidator" />
         <bean id="JWTIdentifierClaimsValidator"
             class="net.shibboleth.oidc.security.jwt.claims.impl.JWTIdentifierClaimsValidator"
             p:clockSkew="%{idp.policy.clockSkew:PT1M}"
             p:replayCache-ref="shibboleth.ReplayCache"
-            p:replayCacheRecordLifetime="%{idp.oauth2.dpop.replayCacheLifetime:PT5M}" />
+            p:replayCacheRecordLifetime="%{idp.oauth2.dpop.replayCacheLifetime:PT5M}">
+            <property name="replayCacheKeyCalculationStrategy">
+                <bean class="net.shibboleth.oidc.security.jwt.claims.impl.CalculateSha256DigestForLongKeyFunction"/>
+            </property>
+        </bean>
         <bean class="net.shibboleth.oidc.security.jwt.claims.impl.ExactMatchClaimsValidator" p:claimName="htm">
             <property name="valueToMatchLookupStrategy">
                 <bean parent="shibboleth.BiFunctions.Expression" c:expression="#custom.get().getMethod()"

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.