[java-idp-oidc] branch main updated: JOIDC-201 - Support for OAuth 2.0 Demonstrating Proof of Possession (DPoP)

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=13921e1e7641228dbe6c15bdd803ca4545f0f098

The following commit(s) were added to refs/heads/main by this push:
     new 13921e1e JOIDC-201 - Support for OAuth 2.0 Demonstrating Proof of Possession (DPoP)
13921e1e is described below

commit 13921e1e7641228dbe6c15bdd803ca4545f0f098
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Wed Sep 11 14:04:32 2024 +0300

    JOIDC-201 - Support for OAuth 2.0 Demonstrating Proof of Possession (DPoP)
    
    https://shibboleth.atlassian.net/browse/JOIDC-201
    
    - Apply the SHA256 hash for the long jti values
    - Removed obsolete 'IssuedAtClaimsValidator' as the claim is already handled by 'DPoPProofIssuedAtClaimsValidator'
---
 .../net/shibboleth/idp/service/relying-party/postconfig.xml        | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index 4779c8ec..a5c1b8aa 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -1057,12 +1057,15 @@
             p:clockSkew="%{idp.policy.clockSkew:PT1M}"
             p:messageLifetime="%{idp.policy.messageLifetime:PT1M}"
             p:requiredRule="true" />
-        <ref bean="IssuedAtClaimsValidator" />
         <bean id="JWTIdentifierClaimsValidator"
             class="net.shibboleth.oidc.security.jwt.claims.impl.JWTIdentifierClaimsValidator"
             p:clockSkew="%{idp.policy.clockSkew:PT1M}"
             p:replayCache-ref="shibboleth.ReplayCache"
-            p:replayCacheRecordLifetime="%{idp.oauth2.dpop.replayCacheLifetime:PT5M}" />
+            p:replayCacheRecordLifetime="%{idp.oauth2.dpop.replayCacheLifetime:PT5M}">
+            <property name="replayCacheKeyCalculationStrategy">
+                <bean class="net.shibboleth.oidc.security.jwt.claims.impl.CalculateSha256DigestForLongKeyFunction"/>
+            </property>
+        </bean>
         <bean class="net.shibboleth.oidc.security.jwt.claims.impl.ExactMatchClaimsValidator" p:claimName="htm">
             <property name="valueToMatchLookupStrategy">
                 <bean parent="shibboleth.BiFunctions.Expression" c:expression="#custom.get().getMethod()"

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.