[java-idp-oidc] branch dev/JOIDC-222 updated: JOIDC-222 - Support for OpenID Federation
Henri Mikkonen
henri.mikkonen at iki.fi
Thu Apr 24 09:04:06 UTC 2025
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch dev/JOIDC-222
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=aa0cde0e2ec07a4641fac1f8b88ce3cec9b75831
The following commit(s) were added to refs/heads/dev/JOIDC-222 by this push:
new aa0cde0e JOIDC-222 - Support for OpenID Federation
aa0cde0e is described below
commit aa0cde0e2ec07a4641fac1f8b88ce3cec9b75831
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Thu Apr 24 12:03:47 2025 +0300
JOIDC-222 - Support for OpenID Federation
https://shibboleth.atlassian.net/browse/JOIDC-222
Improved entity-configuration contents and customization options
- Entity statement contains two claims in addition to openid-configuration:
- federation_registration_endpoint
- client_registration_types_supported (idp.oidfed.entityConfiguration.registrationTypesSupported -property)
- Map of custom claims can be modified via idp.oidfed.configuration.resolver -property
- Defaults to shibboleth.oidfed.DefaultOpenIdConfigurationResolvers
---
.../META-INF/net.shibboleth.idp/postconfig.xml | 40 ++++++++++++++++++++++
.../entity-configuration-beans.xml | 2 +-
.../flow/oidfed/EntityConfigurationFlowTest.java | 17 +++++++--
.../net/shibboleth/idp/module/conf/global.xml | 15 ++++++++
.../net/shibboleth/idp/module/conf/oidc.properties | 3 +-
5 files changed, 72 insertions(+), 5 deletions(-)
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 05fc2260..c9fa7e22 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -909,6 +909,46 @@
<bean id="DefaultMetadataSkeleton" class="org.springframework.core.io.FileSystemResource" lazy-init="true"
c:path="%{idp.oidc.discovery.template:%{idp.home}/static/openid-configuration.json}" />
+ <bean id="shibboleth.oidfed.DefaultOpenIdConfigurationResolver"
+ class="net.shibboleth.idp.plugin.oidc.op.metadata.impl.DynamicFilesystemProviderMetadataResolver"
+ p:minRefreshDelay="%{idp.oidc.config.minRefreshDelay:PT5M}"
+ p:maxRefreshDelay="%{idp.oidc.config.maxRefreshDelay:PT4H}"
+ c:metadata="#{getObject('shibboleth.oidfed.OpenIDConfiguration') ?: getObject('DefaultMetadataSkeleton')}"
+ p:dynamicValueResolvers-ref="#{'%{idp.oidfed.configuration.resolver.values:shibboleth.oidfed.configuration.DefaultDynamicValueResolvers}'.trim()}"/>
+
+ <bean id="shibboleth.oidfed.configuration.DefaultDynamicValueResolvers"
+ parent="shibboleth.oidc.discovery.DefaultDynamicValueResolvers"
+ class="org.springframework.beans.factory.config.MapFactoryBean">
+ <property name="sourceMap">
+ <map merge="true">
+ <entry key="federation_registration_endpoint" value-ref="shibboleth.oidfed.configuration.FederationRegistrationEndpointResolver" />
+ <entry key="client_registration_types_supported" value-ref="shibboleth.oidfed.configuration.RegistrationTypesResolver" />
+ </map>
+ </property>
+ </bean>
+
+ <bean id="shibboleth.oidfed.configuration.FederationRegistrationEndpointResolver"
+ class="net.shibboleth.idp.plugin.oidc.op.metadata.impl.FunctionMetadataValueResolver">
+ <property name="resolverFunction">
+ <bean parent="shibboleth.Functions.Expression"
+ c:expression="#custom.get().getRequestURL().toString().replace('/profile/oidfed/entity-configuration','/profile/oidfed/registration').replace('/.well-known/openid-federation','/profile/oidfed/registration')"
+ p:customObject-ref="shibboleth.HttpServletRequestSupplier" />
+ </property>
+ </bean>
+
+ <bean id="shibboleth.oidfed.configuration.RegistrationTypesResolver"
+ class="net.shibboleth.idp.plugin.oidc.op.metadata.impl.FunctionMetadataValueResolver">
+ <property name="resolverFunction">
+ <bean parent="shibboleth.Functions.Constant">
+ <constructor-arg>
+ <bean class="java.util.List" factory-method="copyOf">
+ <constructor-arg value="%{idp.oidfed.entityConfiguration.registrationTypesSupported:automatic,explicit}" />
+ </bean>
+ </constructor-arg>
+ </bean>
+ </property>
+ </bean>
+
<bean id="shibboleth.oidfed.EntityConfigurationMetadataCache" parent="shibboleth.oidc.CacheBuilder">
<constructor-arg>
<bean p:cacheId="DefaultEntityConfigurationMetadataCache" parent="shibboleth.oidfed.EntityConfigurationMetadataCacheBuilderSpec"
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/entity-configuration/entity-configuration-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/entity-configuration/entity-configuration-beans.xml
index 26d260af..b4db60a7 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/entity-configuration/entity-configuration-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/entity-configuration/entity-configuration-beans.xml
@@ -28,7 +28,7 @@
<bean id="InitializeEntityStatementContext"
class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.InitializeEntityStatementContext"
- p:metadataResolver-ref="#{'%{idp.oidc.discovery.resolver:shibboleth.oidc.DefaultOpenIdConfigurationResolver}'.trim()}"/>
+ p:metadataResolver-ref="#{'%{idp.oidfed.configuration.resolver:shibboleth.oidfed.DefaultOpenIdConfigurationResolver}'.trim()}"/>
<bean id="PopulateEntityStatementSignatureSigningParameters"
class="net.shibboleth.oidc.profile.impl.PopulateJWTSignatureSigningParameters" scope="prototype"
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/EntityConfigurationFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/EntityConfigurationFlowTest.java
index 664a565e..5f44f39b 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/EntityConfigurationFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/EntityConfigurationFlowTest.java
@@ -15,6 +15,8 @@
package net.shibboleth.idp.plugin.oidc.op.profile.flow.oidfed;
import java.io.IOException;
+import java.net.URI;
+import java.net.URISyntaxException;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collection;
@@ -29,6 +31,7 @@ import com.nimbusds.oauth2.sdk.ParseException;
import com.nimbusds.oauth2.sdk.Response;
import com.nimbusds.oauth2.sdk.id.Issuer;
import com.nimbusds.openid.connect.sdk.federation.entities.EntityStatement;
+import com.nimbusds.openid.connect.sdk.federation.registration.ClientRegistrationType;
import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
/**
@@ -44,6 +47,7 @@ public class EntityConfigurationFlowTest extends AbstractFederationFlowTest {
@Test
public void testOutputAndCaching() throws ParseException, IOException, InterruptedException {
+ request.setRequestURI("/idp/profile/oidfed/entity-configuration");
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
final Response response = parseResponse(result);
Assert.assertTrue(response.indicatesSuccess());
@@ -85,9 +89,16 @@ public class EntityConfigurationFlowTest extends AbstractFederationFlowTest {
Assert.assertTrue(containsAll(metadata.getUserInfoJWEEncs(), jweEncs));
Assert.assertNotNull(metadata.getUserInfoJWEEncs());
Assert.assertTrue(containsAll(metadata.getUserInfoJWSAlgs(), jwsAlgs));
- Assert.assertNotNull(metadata.getCustomParameter("STATIC_TEST_ATTRIBUTE"));
- Assert.assertEquals(metadata.getCustomParameter("STATIC_TEST_ATTRIBUTE"), "TestValue");
-
+ Assert.assertNotNull(metadata.getCustomParameter("STATIC_CONF_ATTRIBUTE"));
+ Assert.assertEquals(metadata.getCustomParameter("STATIC_CONF_ATTRIBUTE"), "TestAttributeValue");
+ Assert.assertTrue(metadata.getClientRegistrationTypes().containsAll(
+ List.of(ClientRegistrationType.AUTOMATIC, ClientRegistrationType.EXPLICIT)));
+ try {
+ Assert.assertEquals(metadata.getFederationRegistrationEndpointURI(),
+ new URI("http://localhost/idp/profile/oidfed/registration"));
+ } catch (URISyntaxException e) {
+ Assert.fail("Could not build URI", e);
+ }
}
protected boolean containsAll(Collection<? extends Algorithm> algs, Collection<String> strings) {
diff --git a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/global.xml b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/global.xml
index 54624fdf..f6033c18 100644
--- a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/global.xml
+++ b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/global.xml
@@ -102,6 +102,21 @@
</property>
</bean>
+ <bean id="CustomEntityConfigurationValues" parent="shibboleth.oidfed.configuration.DefaultDynamicValueResolvers"
+ class="org.springframework.beans.factory.config.MapFactoryBean">
+ <property name="sourceMap">
+ <map merge="true">
+ <entry key="STATIC_CONF_ATTRIBUTE">
+ <bean parent="shibboleth.oidc.discovery.FunctionMetadataValueResolver">
+ <property name="resolverFunction">
+ <bean parent="shibboleth.Functions.Constant" c:target="TestAttributeValue"/>
+ </property>
+ </bean>
+ </entry>
+ </map>
+ </property>
+ </bean>
+
<bean id="alwaysTruePolicyOperator" class="net.shibboleth.idp.plugin.oidc.op.profile.flow.AlwaysTrueCustomMetadataPolicyOperator" />
<bean id="alwaysFalsePolicyOperator" class="net.shibboleth.idp.plugin.oidc.op.profile.flow.AlwaysFalseCustomMetadataPolicyOperator" />
diff --git a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/oidc.properties b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/oidc.properties
index dd370e35..cf1ef425 100644
--- a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/oidc.properties
+++ b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/oidc.properties
@@ -23,4 +23,5 @@ idp.oidc.discovery.resolver.values = CustomConfigurationValues
idp.oidc.DefaultUnregisteredClientPolicyFile = src/test/resources/net/shibboleth/idp/module/conf/unregistered-policy.json
idp.oidfed.authorize.automaticRegistrationCondition = shibboleth.Conditions.TRUE
-idp.oidfed.par.automaticRegistrationCondition = shibboleth.Conditions.TRUE
\ No newline at end of file
+idp.oidfed.par.automaticRegistrationCondition = shibboleth.Conditions.TRUE
+idp.oidfed.configuration.resolver.values = CustomEntityConfigurationValues
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list