[java-idp-oidc] branch dev/JOIDC-222 updated: JOIDC-222 - Support for OpenID Federation

Henri Mikkonen henri.mikkonen at iki.fi
Thu Apr 24 09:04:06 UTC 2025


This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch dev/JOIDC-222
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=aa0cde0e2ec07a4641fac1f8b88ce3cec9b75831

The following commit(s) were added to refs/heads/dev/JOIDC-222 by this push:
     new aa0cde0e JOIDC-222 - Support for OpenID Federation
aa0cde0e is described below

commit aa0cde0e2ec07a4641fac1f8b88ce3cec9b75831
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Thu Apr 24 12:03:47 2025 +0300

    JOIDC-222 - Support for OpenID Federation
    
    https://shibboleth.atlassian.net/browse/JOIDC-222
    
    Improved entity-configuration contents and customization options
    - Entity statement contains two claims in addition to openid-configuration:
      - federation_registration_endpoint
      - client_registration_types_supported (idp.oidfed.entityConfiguration.registrationTypesSupported -property)
    - Map of custom claims can be modified via idp.oidfed.configuration.resolver -property
      - Defaults to shibboleth.oidfed.DefaultOpenIdConfigurationResolvers
---
 .../META-INF/net.shibboleth.idp/postconfig.xml     | 40 ++++++++++++++++++++++
 .../entity-configuration-beans.xml                 |  2 +-
 .../flow/oidfed/EntityConfigurationFlowTest.java   | 17 +++++++--
 .../net/shibboleth/idp/module/conf/global.xml      | 15 ++++++++
 .../net/shibboleth/idp/module/conf/oidc.properties |  3 +-
 5 files changed, 72 insertions(+), 5 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 05fc2260..c9fa7e22 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -909,6 +909,46 @@
     <bean id="DefaultMetadataSkeleton" class="org.springframework.core.io.FileSystemResource" lazy-init="true"
         c:path="%{idp.oidc.discovery.template:%{idp.home}/static/openid-configuration.json}" />
 
+    <bean id="shibboleth.oidfed.DefaultOpenIdConfigurationResolver"
+        class="net.shibboleth.idp.plugin.oidc.op.metadata.impl.DynamicFilesystemProviderMetadataResolver"
+        p:minRefreshDelay="%{idp.oidc.config.minRefreshDelay:PT5M}"
+        p:maxRefreshDelay="%{idp.oidc.config.maxRefreshDelay:PT4H}"
+        c:metadata="#{getObject('shibboleth.oidfed.OpenIDConfiguration') ?: getObject('DefaultMetadataSkeleton')}"
+        p:dynamicValueResolvers-ref="#{'%{idp.oidfed.configuration.resolver.values:shibboleth.oidfed.configuration.DefaultDynamicValueResolvers}'.trim()}"/>
+
+    <bean id="shibboleth.oidfed.configuration.DefaultDynamicValueResolvers"
+        parent="shibboleth.oidc.discovery.DefaultDynamicValueResolvers"
+        class="org.springframework.beans.factory.config.MapFactoryBean">
+        <property name="sourceMap">
+            <map merge="true">
+                <entry key="federation_registration_endpoint" value-ref="shibboleth.oidfed.configuration.FederationRegistrationEndpointResolver" />
+                <entry key="client_registration_types_supported" value-ref="shibboleth.oidfed.configuration.RegistrationTypesResolver" />
+           </map>
+       </property>
+    </bean>
+
+    <bean id="shibboleth.oidfed.configuration.FederationRegistrationEndpointResolver"
+        class="net.shibboleth.idp.plugin.oidc.op.metadata.impl.FunctionMetadataValueResolver">
+        <property name="resolverFunction">
+            <bean parent="shibboleth.Functions.Expression"
+                c:expression="#custom.get().getRequestURL().toString().replace('/profile/oidfed/entity-configuration','/profile/oidfed/registration').replace('/.well-known/openid-federation','/profile/oidfed/registration')"
+                p:customObject-ref="shibboleth.HttpServletRequestSupplier" />
+        </property>
+    </bean>
+
+    <bean id="shibboleth.oidfed.configuration.RegistrationTypesResolver"
+        class="net.shibboleth.idp.plugin.oidc.op.metadata.impl.FunctionMetadataValueResolver">
+        <property name="resolverFunction">
+            <bean parent="shibboleth.Functions.Constant">
+                <constructor-arg>
+                    <bean class="java.util.List" factory-method="copyOf">
+                        <constructor-arg value="%{idp.oidfed.entityConfiguration.registrationTypesSupported:automatic,explicit}" />
+                     </bean>
+                </constructor-arg>
+            </bean>
+        </property>
+    </bean>
+
     <bean id="shibboleth.oidfed.EntityConfigurationMetadataCache" parent="shibboleth.oidc.CacheBuilder">
         <constructor-arg>
             <bean p:cacheId="DefaultEntityConfigurationMetadataCache" parent="shibboleth.oidfed.EntityConfigurationMetadataCacheBuilderSpec"
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/entity-configuration/entity-configuration-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/entity-configuration/entity-configuration-beans.xml
index 26d260af..b4db60a7 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/entity-configuration/entity-configuration-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/entity-configuration/entity-configuration-beans.xml
@@ -28,7 +28,7 @@
 
     <bean id="InitializeEntityStatementContext"
         class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.InitializeEntityStatementContext"
-        p:metadataResolver-ref="#{'%{idp.oidc.discovery.resolver:shibboleth.oidc.DefaultOpenIdConfigurationResolver}'.trim()}"/>
+        p:metadataResolver-ref="#{'%{idp.oidfed.configuration.resolver:shibboleth.oidfed.DefaultOpenIdConfigurationResolver}'.trim()}"/>
 
     <bean id="PopulateEntityStatementSignatureSigningParameters"
         class="net.shibboleth.oidc.profile.impl.PopulateJWTSignatureSigningParameters" scope="prototype"
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/EntityConfigurationFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/EntityConfigurationFlowTest.java
index 664a565e..5f44f39b 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/EntityConfigurationFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/EntityConfigurationFlowTest.java
@@ -15,6 +15,8 @@
 package net.shibboleth.idp.plugin.oidc.op.profile.flow.oidfed;
 
 import java.io.IOException;
+import java.net.URI;
+import java.net.URISyntaxException;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collection;
@@ -29,6 +31,7 @@ import com.nimbusds.oauth2.sdk.ParseException;
 import com.nimbusds.oauth2.sdk.Response;
 import com.nimbusds.oauth2.sdk.id.Issuer;
 import com.nimbusds.openid.connect.sdk.federation.entities.EntityStatement;
+import com.nimbusds.openid.connect.sdk.federation.registration.ClientRegistrationType;
 import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
 
 /**
@@ -44,6 +47,7 @@ public class EntityConfigurationFlowTest extends AbstractFederationFlowTest {
 
     @Test
     public void testOutputAndCaching() throws ParseException, IOException, InterruptedException {
+        request.setRequestURI("/idp/profile/oidfed/entity-configuration");
         final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
         final Response response = parseResponse(result);
         Assert.assertTrue(response.indicatesSuccess());
@@ -85,9 +89,16 @@ public class EntityConfigurationFlowTest extends AbstractFederationFlowTest {
         Assert.assertTrue(containsAll(metadata.getUserInfoJWEEncs(), jweEncs));
         Assert.assertNotNull(metadata.getUserInfoJWEEncs());
         Assert.assertTrue(containsAll(metadata.getUserInfoJWSAlgs(), jwsAlgs));
-        Assert.assertNotNull(metadata.getCustomParameter("STATIC_TEST_ATTRIBUTE"));
-        Assert.assertEquals(metadata.getCustomParameter("STATIC_TEST_ATTRIBUTE"), "TestValue");
-
+        Assert.assertNotNull(metadata.getCustomParameter("STATIC_CONF_ATTRIBUTE"));
+        Assert.assertEquals(metadata.getCustomParameter("STATIC_CONF_ATTRIBUTE"), "TestAttributeValue");
+        Assert.assertTrue(metadata.getClientRegistrationTypes().containsAll(
+                List.of(ClientRegistrationType.AUTOMATIC, ClientRegistrationType.EXPLICIT)));
+        try {
+            Assert.assertEquals(metadata.getFederationRegistrationEndpointURI(),
+                    new URI("http://localhost/idp/profile/oidfed/registration"));
+        } catch (URISyntaxException e) {
+            Assert.fail("Could not build URI", e);
+        }
     }
 
     protected boolean containsAll(Collection<? extends Algorithm> algs, Collection<String> strings) {
diff --git a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/global.xml b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/global.xml
index 54624fdf..f6033c18 100644
--- a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/global.xml
+++ b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/global.xml
@@ -102,6 +102,21 @@
         </property>
     </bean>
 
+    <bean id="CustomEntityConfigurationValues" parent="shibboleth.oidfed.configuration.DefaultDynamicValueResolvers"
+        class="org.springframework.beans.factory.config.MapFactoryBean">
+        <property name="sourceMap">
+            <map merge="true">
+                <entry key="STATIC_CONF_ATTRIBUTE">
+                    <bean parent="shibboleth.oidc.discovery.FunctionMetadataValueResolver">
+                        <property name="resolverFunction">
+                            <bean parent="shibboleth.Functions.Constant" c:target="TestAttributeValue"/>
+                        </property>
+                    </bean>
+                </entry>
+            </map>
+        </property>
+    </bean>
+
     <bean id="alwaysTruePolicyOperator" class="net.shibboleth.idp.plugin.oidc.op.profile.flow.AlwaysTrueCustomMetadataPolicyOperator" />
 
     <bean id="alwaysFalsePolicyOperator" class="net.shibboleth.idp.plugin.oidc.op.profile.flow.AlwaysFalseCustomMetadataPolicyOperator" />
diff --git a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/oidc.properties b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/oidc.properties
index dd370e35..cf1ef425 100644
--- a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/oidc.properties
+++ b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/oidc.properties
@@ -23,4 +23,5 @@ idp.oidc.discovery.resolver.values = CustomConfigurationValues
 idp.oidc.DefaultUnregisteredClientPolicyFile = src/test/resources/net/shibboleth/idp/module/conf/unregistered-policy.json
 
 idp.oidfed.authorize.automaticRegistrationCondition = shibboleth.Conditions.TRUE
-idp.oidfed.par.automaticRegistrationCondition = shibboleth.Conditions.TRUE
\ No newline at end of file
+idp.oidfed.par.automaticRegistrationCondition = shibboleth.Conditions.TRUE
+idp.oidfed.configuration.resolver.values = CustomEntityConfigurationValues

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the commits mailing list