[java-plugin-shibd-oidc] branch main updated: Add oidc-commons via explicit import and update test classes/resources
Phil Smart
philip.smart at jisc.ac.uk
Fri Aug 8 15:44:13 UTC 2025
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-plugin-shibd-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-plugin-shibd-oidc.git;a=commit;h=b5aaecceccb46c60bb067bdb0bb09cf42a7e65ba
The following commit(s) were added to refs/heads/main by this push:
new b5aaecc Add oidc-commons via explicit import and update test classes/resources
b5aaecc is described below
commit b5aaecceccb46c60bb067bdb0bb09cf42a7e65ba
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Aug 8 16:44:11 2025 +0100
Add oidc-commons via explicit import and update test classes/resources
- Changes to allow a no-op OIDC flow to run.
- More changes needed. This is a WIP as I explore the SP.
- Can not use the BOM as it brings in the wrong version of the IdP, so
just list the artifacts we need from OIDC-Common
---
pom.xml | 114 +++++--
sp-oidc-conf-impl/pom.xml | 53 ++++
.../idp/flows/sp/initiator/oidc/oidc-beans.xml | 203 ++++++++++++
.../idp/flows/sp/initiator/oidc/oidc-flow.xml | 41 +++
.../net/shibboleth/sp/service/agent/postconfig.xml | 348 +++++++++++++++++++++
.../idp/module/conf/rp/oidc-credentials.xml | 47 ---
.../shibboleth/idp/module/conf/rp/oidc.properties | 2 -
.../idp/module/conf/sp/oidc-credentials.xml | 79 +++++
.../shibboleth/idp/module/conf/sp/oidc.properties | 19 ++
.../net/shibboleth/sp/oidc/conf/module.properties | 8 +-
.../sp/oidc/flows/OIDCAuthenticationFlowTest.java | 87 ++++++
...DCEnvironmentApplicationContextInitializer.java | 55 ++++
.../test/resources/logback-webauthn-flow-test.xml | 25 ++
.../idp/module/conf/attributes/default-rules.xml | 3 +-
.../net/shibboleth/idp/module/conf/sp/agents.xml | 5 +-
.../{saml-test-agents.xml => oidc-test-agents.xml} | 26 +-
.../module/credentials/sp/sp-encryption-rsa.jwk | 13 +
.../idp/module/credentials/sp/sp-signing-es.jwk | 9 +
.../idp/module/credentials/sp/sp-signing-rs.jwk | 13 +
.../net/shibboleth/sp/oidc-test-beans.xml | 4 +-
20 files changed, 1060 insertions(+), 94 deletions(-)
diff --git a/pom.xml b/pom.xml
index c0ca35e..d81cbb3 100644
--- a/pom.xml
+++ b/pom.xml
@@ -1,20 +1,22 @@
-<!-- See LICENSE.txt file in the root directory of this repository for the copyright/license information. -->
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+<!-- See LICENSE.txt file in the root directory of this repository for the
+copyright/license information. -->
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
-
+
<parent>
<groupId>net.shibboleth</groupId>
<artifactId>parent</artifactId>
<version>17.2.0-SNAPSHOT</version>
</parent>
-
+
<groupId>net.shibboleth.sp</groupId>
<artifactId>sp-oidc-parent</artifactId>
<version>0.0.1-SNAPSHOT</version>
<name>Shibboleth SP :: OIDC Protocol Plugin</name>
<packaging>pom</packaging>
-
+
<properties>
<shibboleth.projectName>java-plugin-shibd-oidc</shibboleth.projectName>
<shib-shared.groupId>net.shibboleth</shib-shared.groupId>
@@ -29,17 +31,21 @@
<shib-profile.version>5.2.0-SNAPSHOT</shib-profile.version>
<oidc-common.groupId>net.shibboleth.oidc</oidc-common.groupId>
<oidc-common.version>3.3.0</oidc-common.version>
+ <oidc-config.groupId>net.shibboleth.idp.plugin.config.oidc</oidc-config.groupId>
+ <oidc-config.version>3.0.0</oidc-config.version>
<idp.groupId>net.shibboleth.idp</idp.groupId>
<idp.version>5.2.0-SNAPSHOT</idp.version>
<shibd.groupId>net.shibboleth.sp</shibd.groupId>
<shibd.version>0.0.1-SNAPSHOT</shibd.version>
- <checkstyle.configLocation>${project.basedir}/resources/checkstyle/checkstyle.xml</checkstyle.configLocation>
+ <checkstyle.configLocation>
+ ${project.basedir}/resources/checkstyle/checkstyle.xml</checkstyle.configLocation>
</properties>
-
+
<description>
- IdP plugin to add OIDC protocol support to the SP processing hub and agents.
+ IdP plugin to add OIDC protocol support to the SP processing hub and
+ agents.
</description>
-
+
<modules>
<module>sp-oidc-bom</module>
<module>sp-oidc-conf-impl</module>
@@ -47,7 +53,7 @@
<module>sp-oidc-impl</module>
<module>sp-oidc-dist</module>
</modules>
-
+
<dependencies>
<!-- Project wide Dependencies -->
<dependency>
@@ -80,6 +86,13 @@
</dependencies>
<dependencyManagement>
<dependencies>
+ <!-- OIDC Shared config, which is a runtime dependency to the whole
+ project -->
+ <dependency>
+ <groupId>${oidc-config.groupId}</groupId>
+ <artifactId>idp-plugin-oidc-config-impl</artifactId>
+ <version>${oidc-config.version}</version>
+ </dependency>
<!-- Import Dependencies: Shib-Shared -->
<dependency>
<groupId>${shib-shared.groupId}</groupId>
@@ -96,14 +109,67 @@
<type>pom</type>
<scope>import</scope>
</dependency>
- <!-- OIDC Common BOM when importing OIDC dependencies
+ <!-- OIDC Common BOM when importing OIDC dependencies
<dependency>
<groupId>${oidc-common.groupId}</groupId>
<artifactId>oidc-common-bom</artifactId>
<version>${oidc-common.version}</version>
<type>pom</type>
<scope>import</scope>
- </dependency> -->
+ </dependency>-->
+ <!-- Pull in OIDC dependencies one by one, the BOM will import
+ incorrect transitive dependency versions -->
+
+ <!-- TODO should we pull config from here? Harder for tests?<dependency>
+ <groupId>${oidc-config.groupId}</groupId>
+ <artifactId>idp-plugin-oidc-config-impl</artifactId>
+ <version>${oidc-config.version}</version>
+ </dependency>-->
+ <dependency>
+ <groupId>${oidc-common.groupId}</groupId>
+ <artifactId>oidc-common-profile-api</artifactId>
+ <version>${oidc-common.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>${oidc-common.groupId}</groupId>
+ <artifactId>oidc-common-crypto-impl</artifactId>
+ <version>${oidc-common.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>${oidc-common.groupId}</groupId>
+ <artifactId>oidc-common-crypto-api</artifactId>
+ <version>${oidc-common.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>${oidc-common.groupId}</groupId>
+ <artifactId>oidc-common-metadata-impl</artifactId>
+ <version>${oidc-common.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>${oidc-common.groupId}</groupId>
+ <artifactId>oidc-common-metadata-api</artifactId>
+ <version>${oidc-common.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>${oidc-common.groupId}</groupId>
+ <artifactId>oidc-common-attribute-api</artifactId>
+ <version>${oidc-common.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>${oidc-common.groupId}</groupId>
+ <artifactId>oidc-common-attribute-impl</artifactId>
+ <version>${oidc-common.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>${oidc-common.groupId}</groupId>
+ <artifactId>oidc-common-profile-api</artifactId>
+ <version>${oidc-common.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>${oidc-common.groupId}</groupId>
+ <artifactId>oidc-common-profile-impl</artifactId>
+ <version>${oidc-common.version}</version>
+ </dependency>
<!-- Import Dependencies: Shib-Metadata/Attribute/Profile -->
<dependency>
<groupId>${shib-profile.groupId}</groupId>
@@ -158,21 +224,21 @@
</manifestEntries>
</archive>
</configuration>
- </plugin>
+ </plugin>
</plugins>
- <pluginManagement>
+ <pluginManagement>
<plugins>
- <plugin>
- <groupId>org.codehaus.mojo</groupId>
- <artifactId>exec-maven-plugin</artifactId>
- <version>3.0.0</version>
- <configuration>
- <mainClass>unused</mainClass>
- <skip>true</skip>
- </configuration>
- </plugin>
- </plugins>
+ <plugin>
+ <groupId>org.codehaus.mojo</groupId>
+ <artifactId>exec-maven-plugin</artifactId>
+ <version>3.0.0</version>
+ <configuration>
+ <mainClass>unused</mainClass>
+ <skip>true</skip>
+ </configuration>
+ </plugin>
+ </plugins>
</pluginManagement>
</build>
diff --git a/sp-oidc-conf-impl/pom.xml b/sp-oidc-conf-impl/pom.xml
index 54b1aea..da38193 100644
--- a/sp-oidc-conf-impl/pom.xml
+++ b/sp-oidc-conf-impl/pom.xml
@@ -78,6 +78,52 @@
<scope>provided</scope>
</dependency>
+ <!-- TODO: should we pull config from here <dependency>
+ <groupId>${oidc-config.groupId}</groupId>
+ <artifactId>idp-plugin-oidc-config-impl</artifactId>
+ <scope>provided</scope>
+ </dependency>-->
+ <dependency>
+ <groupId>${oidc-common.groupId}</groupId>
+ <artifactId>oidc-common-crypto-impl</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${oidc-common.groupId}</groupId>
+ <artifactId>oidc-common-crypto-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${oidc-common.groupId}</groupId>
+ <artifactId>oidc-common-metadata-impl</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${oidc-common.groupId}</groupId>
+ <artifactId>oidc-common-metadata-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${oidc-common.groupId}</groupId>
+ <artifactId>oidc-common-attribute-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${oidc-common.groupId}</groupId>
+ <artifactId>oidc-common-attribute-impl</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${oidc-common.groupId}</groupId>
+ <artifactId>oidc-common-profile-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${oidc-common.groupId}</groupId>
+ <artifactId>oidc-common-profile-impl</artifactId>
+ <scope>provided</scope>
+ </dependency>
+
<dependency>
<groupId>${opensaml.groupId}</groupId>
<artifactId>opensaml-core-api</artifactId>
@@ -177,6 +223,13 @@
<artifactId>idp-conf-impl</artifactId>
<scope>test</scope>
</dependency>
+
+ <!-- To Provide OIDC.SSO profile beans. TODO should we duplicate these instead of including this in tests?
+ <dependency>
+ <groupId>${oidc-config.groupId}</groupId>
+ <artifactId>idp-plugin-oidc-config-impl</artifactId>
+ <scope>test</scope>
+ </dependency>-->
<dependency>
<groupId>${idp.groupId}</groupId>
diff --git a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/oidc/oidc-beans.xml b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/oidc/oidc-beans.xml
new file mode 100644
index 0000000..fb5acb4
--- /dev/null
+++ b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/oidc/oidc-beans.xml
@@ -0,0 +1,203 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans" xmlns:c="http://www.springframework.org/schema/c"
+ xmlns:context="http://www.springframework.org/schema/context" xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:util="http://www.springframework.org/schema/util" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+ default-init-method="initialize" default-destroy-method="destroy">
+
+ <!-- <util:constant id="shiibboleth.sp.ProfileId"
+ static-field="net.shibboleth.saml.saml2.profile.config.BrowserSSOProfileConfiguration.PROFILE_ID" />
+
+ <import resource="classpath:/META-INF/net/shibboleth/idp/flows/sp/saml2-common-beans.xml" />
+
+ <bean id="ValidateSessionInitiatorRequest"
+ class="net.shibboleth.sp.profile.impl.ValidateSessionInitiatorRequest" scope="prototype"
+ p:flowId="saml2"
+ p:requireDiscoveryURL="false"
+ p:requireRelyingPartyId="true" />
+
+ <bean id="PrepareInboundMessageContext"
+ class="net.shibboleth.idp.saml.session.impl.PrepareInboundMessageContext" scope="prototype"
+ p:relyingPartyLookupStrategy-ref="shibboleth.RelyingPartyIdLookup.Simple" />
+
+ <bean id="InitializeOutboundMessageContext"
+ class="net.shibboleth.idp.saml.profile.impl.InitializeOutboundMessageContext" scope="prototype"
+ p:selfIdentityLookupStrategy-ref="shibboleth.IssuerLookup.Simple" />
+
+ <bean id="InitializeMessageChannelSecurityContext"
+ class="org.opensaml.profile.action.impl.StaticMessageChannelSecurity" scope="prototype"
+ p:confidentialityActive="false"
+ p:integrityActive="false" />
+
+ <util:constant id="shibboleth.EndpointType"
+ static-field="org.opensaml.saml.saml2.metadata.SingleSignOnService.DEFAULT_ELEMENT_NAME" />
+
+ <util:list id="OutgoingSAML2SPRequestBindings">
+ <ref bean="shibboleth.Binding.SAML2Redirect" />
+ <ref bean="shibboleth.Binding.SAML2POST" />
+ <ref bean="shibboleth.Binding.SAML2POSTSimpleSign" />
+ </util:list>
+
+ <bean id="OutgoingSAML2SPRequestBindingsStrategy" parent="shibboleth.Functions.Constant"
+ c:_0-ref="OutgoingSAML2SPRequestBindings" />
+
+ <bean id="PopulateBindingAndEndpointContexts"
+ class="net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts" scope="prototype"
+ p:endpointResolver-ref="shibboleth.EndpointResolver"
+ p:endpointType-ref="shibboleth.EndpointType"
+ p:bindingDescriptorsLookupStrategy-ref="OutgoingSAML2SPRequestBindingsStrategy"
+ p:artifactImpliesSecureChannel="%{sp.artifact.secureChannel:true}" />
+
+ <bean id="PopulateRequestSignatureSigningParameters"
+ class="org.opensaml.saml.common.profile.impl.PopulateSignatureSigningParameters" scope="prototype"
+ p:configurationLookupStrategy-ref="shibboleth.SignatureSigningConfigurationLookup"
+ p:signatureSigningParametersResolver-ref="shibboleth.SignatureSigningParametersResolver"
+ p:noResultIsError="false">
+ <property name="activationCondition">
+ <bean class="net.shibboleth.saml.profile.config.logic.SignRequestsPredicate"
+ p:honorMetadata="%{sp.saml.honorWantAuthnRequestsSigned:true}" />
+ </property>
+ </bean>
+
+ <bean id="PopulateEncryptionParameters"
+ class="net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters" scope="prototype"
+ p:configurationLookupStrategy-ref="shibboleth.EncryptionConfigurationLookup"
+ p:encryptionParametersResolver-ref="shibboleth.EncryptionParametersResolver"
+ p:protocol-ref="shibboleth.MetadataLookup.Protocol"
+ p:role-ref="shibboleth.MetadataLookup.Role" />
+
+ <util:map id="InboundSAML2BindingMap">
+ <entry key="POST">
+ <util:constant static-field="org.opensaml.saml.common.xml.SAMLConstants.SAML2_POST_BINDING_URI" />
+ </entry>
+ <entry key="POST-SimpleSign">
+ <util:constant static-field="org.opensaml.saml.common.xml.SAMLConstants.SAML2_POST_SIMPLE_SIGN_BINDING_URI" />
+ </entry>
+ <entry key="Artifact">
+ <util:constant static-field="org.opensaml.saml.common.xml.SAMLConstants.SAML2_ARTIFACT_BINDING_URI" />
+ </entry>
+ </util:map>
+
+ <bean id="AddAuthnRequest"
+ class="net.shibboleth.sp.saml.saml2.profile.impl.AddAuthnRequest" scope="prototype"
+ p:overwriteExisting="true"
+ p:nameIDLookupStrategy="#{getObject('%{sp.authn.SAML.NameIDLookupStrategy:}'.trim())}"
+ p:inboundBindingMap-ref="InboundSAML2BindingMap">
+ <property name="identifierGeneratorLookupStrategy">
+ <bean class="net.shibboleth.profile.config.navigate.IdentifierGenerationStrategyLookupFunction"
+ p:defaultIdentifierGenerationStrategy-ref="shibboleth.DefaultIdentifierGenerationStrategy" />
+ </property>
+ </bean>
+
+ Default formats not to encrypt.
+ <util:set id="DefaultPlaintextNameIDFormats">
+ <util:constant static-field="org.opensaml.saml.saml2.core.NameIDType.ENTITY" />
+ </util:set>
+
+ <bean id="EncryptNameIDs"
+ class="org.opensaml.saml.saml2.profile.impl.EncryptNameIDs" scope="prototype"
+ p:excludedFormats="#{getObject('shibboleth.PlaintextNameIDFormats') ?: getObject('DefaultPlaintextNameIDFormats')}"
+ p:recipientLookupStrategy-ref="shibboleth.RelyingPartyIdLookup.Simple">
+ <property name="encryptionContextLookupStrategy">
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.ChildLookup.EncryptionParameters"
+ c:f-ref="shibboleth.ChildLookup.RelyingParty" />
+ </property>
+ </bean>
+
+ <bean id="HandleOutboundMessage"
+ class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor" scope="prototype"
+ c:messageHandler-ref="PreEncodeMessageHandler"
+ c:executionDirection="OUTBOUND">
+ <property name="errorEvent">
+ <util:constant static-field="org.opensaml.profile.action.EventIds.MESSAGE_PROC_ERROR" />
+ </property>
+ </bean>
+
+ <bean id="PreEncodeMessageHandler"
+ class="org.opensaml.messaging.handler.impl.BasicMessageHandlerChain" scope="prototype">
+ <property name="handlers">
+ <list>
+ <bean class="org.opensaml.messaging.handler.impl.FunctionMessageHandler" scope="prototype">
+ <property name="functionLookupStrategy">
+ <bean class="net.shibboleth.saml.profile.config.navigate.messaging.MessageHandlerLookupFunction" />
+ </property>
+ </bean>
+ <bean class="org.opensaml.saml.common.binding.impl.SAMLOutboundDestinationHandler" scope="prototype"/>
+ <bean class="org.opensaml.saml.common.binding.security.impl.EndpointURLSchemeSecurityHandler" scope="prototype"/>
+ <bean class="org.opensaml.saml.common.binding.security.impl.SAMLOutboundProtocolMessageSigningHandler" scope="prototype">
+ <property name="activationCondition">
+ <bean parent="shibboleth.Conditions.NOT">
+ <constructor-arg>
+ <bean class="org.opensaml.saml.common.messaging.logic.SignatureCapableBindingPredicate" />
+ </constructor-arg>
+ </bean>
+ </property>
+ </bean>
+ </list>
+ </property>
+ </bean>
+
+ <bean id="IssueCorrelationCookie" class="net.shibboleth.sp.profile.impl.IssueCorrelationCookie" scope="prototype"
+ p:cookieManager-ref="shibboleth.RemotedCookieManager"
+ p:cookiePrefix="%{sp.correlation.cookiePrefix:__Host-_shibsp_req_}"
+ p:createOutputObjects="true"
+ p:errorFatal="%{sp.stateToken.errorsFatal:false}"
+ p:requestIDLookupStrategy-ref="RequestIDStrategy"
+ p:passiveRequestPredicate-ref="PassivePredicate" />
+
+ <bean id="RequestIDStrategy" parent="shibboleth.Functions.Compose">
+ <constructor-arg name="g">
+ <bean class="org.opensaml.saml.common.messaging.context.navigate.SAMLMessageInfoContextIDFunction" />
+ </constructor-arg>
+ <constructor-arg name="f">
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.ChildLookupOrCreate.SAMLMessageInfoContext"
+ c:f-ref="shibboleth.MessageContextLookup.Outbound" />
+ </constructor-arg>
+ </bean>
+
+ <bean id="PassivePredicate" class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean class="net.shibboleth.idp.saml.audit.impl.IsPassiveAuditExtractor">
+ <constructor-arg>
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.MessageLookup.AuthnRequest"
+ c:f-ref="shibboleth.MessageContextLookup.Outbound" />
+ </constructor-arg>
+ </bean>
+ </constructor-arg>
+ <constructor-arg>
+ <ref bean="shibboleth.Conditions.FALSE" />
+ </constructor-arg>
+ </bean>
+
+ <bean id="messageEncoderFactory" class="net.shibboleth.idp.saml.profile.impl.SpringAwareMessageEncoderFactory" />
+
+ <bean id="EncodeMessage" class="net.shibboleth.sp.profile.impl.EncodeMessage" scope="prototype"
+ p:createOutputObjects="true"
+ p:messageEncoderFactory-ref="messageEncoderFactory" />
+
+ Override IdP's encoders to supply the DDF-backed servlet supplier.
+
+ <bean id="shibboleth.Encoders.SAML2RedirectEncoder"
+ class="org.opensaml.saml.saml2.binding.encoding.impl.HTTPRedirectDeflateEncoder" scope="prototype" init-method=""
+ p:httpServletResponseSupplier-ref="shibboleth.RemotedHttpServletResponseSupplier" />
+
+ <bean id="shibboleth.Encoders.SAML2PostEncoder"
+ class="org.opensaml.saml.saml2.binding.encoding.impl.HTTPPostEncoder" scope="prototype" init-method=""
+ p:httpServletResponseSupplier-ref="shibboleth.RemotedHttpServletResponseSupplier"
+ p:velocityEngine-ref="shibboleth.VelocityEngine"
+ p:cSPDigester="#{%{sp.encoders.cspEnabled:true} ? getObject('shibboleth.CSPDigester') : null}"
+ p:cSPNonceGenerator="#{%{sp.encoders.cspEnabled:true} ? getObject('shibboleth.CSPNonce') : null}" />
+
+ <bean id="shibboleth.Encoders.SAML2PostSimpleSignEncoder"
+ class="org.opensaml.saml.saml2.binding.encoding.impl.HTTPPostSimpleSignEncoder" scope="prototype" init-method=""
+ p:httpServletResponseSupplier-ref="shibboleth.RemotedHttpServletResponseSupplier"
+ p:velocityEngine-ref="shibboleth.VelocityEngine"
+ p:cSPDigester="#{%{sp.encoders.cspEnabled:true} ? getObject('shibboleth.CSPDigester') : null}"
+ p:cSPNonceGenerator="#{%{sp.encoders.cspEnabled:true} ? getObject('shibboleth.CSPNonce') : null}" /> -->
+
+</beans>
diff --git a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/oidc/oidc-flow.xml b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/oidc/oidc-flow.xml
new file mode 100644
index 0000000..48e100e
--- /dev/null
+++ b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/oidc/oidc-flow.xml
@@ -0,0 +1,41 @@
+<flow xmlns="http://www.springframework.org/schema/webflow"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/webflow http://www.springframework.org/schema/webflow/spring-webflow.xsd"
+ parent="sp/initiator">
+
+ <!-- TODO. OIDC does not have the same session initiation mechanisms as SAML, so we will add our own -->
+
+ <!-- <action-state id="SAML2SessionInitiator">
+ <evaluate expression="ValidateSessionInitiatorRequest" />
+ <evaluate expression="PrepareInboundMessageContext" />
+ <evaluate expression="SAMLProtocolAndRole" />
+ <evaluate expression="SAMLMetadataLookup" />
+
+ <evaluate expression="InitializeRelyingPartyContextFromSAMLPeer" />
+ <evaluate expression="SelectRelyingPartyConfiguration" />
+ <evaluate expression="SelectProfileConfiguration" />
+
+ <evaluate expression="InitializeOutboundMessageContext" />
+ <evaluate expression="InitializeMessageChannelSecurityContext" />
+ <evaluate expression="PopulateBindingAndEndpointContexts" />
+
+ <evaluate expression="PopulateRequestSignatureSigningParameters" />
+ <evaluate expression="PopulateEncryptionParameters" />
+
+ <evaluate expression="AddAuthnRequest" />
+ <evaluate expression="EncryptNameIDs" />
+
+ <evaluate expression="HandleOutboundMessage" />
+ <evaluate expression="IssueCorrelationCookie" />
+ <evaluate expression="EncodeMessage" />
+ <evaluate expression="'proceed'" />
+
+ <transition on="proceed" to="proceed" />
+ Remap any other events into a fall-through to the next flow.
+ <transition to="ReselectFlow" />
+ </action-state> -->
+
+ <!-- The file really exists in this directory, but it's referenced from extending flow-directories -->
+ <bean-import resource="classpath:/META-INF/net/shibboleth/idp/flows/sp/initiator/oidc/oidc-beans.xml" />
+
+</flow>
diff --git a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml
index e8cd7f4..bdd2080 100644
--- a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml
+++ b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml
@@ -24,6 +24,354 @@
a suite of metadata-driven lookup strategies pre-injected.
-->
+ <!-- Credential bean factories -->
+ <bean id="shibboleth.oidc.ClientSecretCredential" abstract="true"
+ class="net.shibboleth.oidc.security.credential.BasicClientSecretCredentialFactoryBean" />
+
+ <bean id="shibboleth.oidc.JWKCredential" abstract="true"
+ class="net.shibboleth.oidc.security.credential.BasicJWKCredentialFactoryBean" />
+
+ <!-- Singleton JWK cache -->
+ <bean id="shibboleth.oidc.RemoteJwkSetCache"
+ class="net.shibboleth.oidc.jwk.RemoteJwkSetCache"
+ p:storage-ref="#{'%{idp.oidc.jwk.StorageService:shibboleth.StorageService}'.trim()}"
+ p:httpClient="#{getObject('shibboleth.oidc.NonBrowser.HttpClient') ?: getObject('shibboleth.InternalHttpClient')}"
+ p:httpClientSecurityParameters="#{getObject('shibboleth.oidc.NonBrowser.HttpClientSecurityParameters')}" />
+
+ <!--
+ Security Configuration Defaults. These settings establish the default security configurations for
+ signatures and loads the default credentials used.
+ -->
+ <bean id="shibboleth.oidc.BasicSignatureValidationConfiguration" abstract="true"
+ class="net.shibboleth.oidc.security.jose.impl.BasicSignatureValidationConfiguration"
+ p:includedAlgorithms="#{getObject('shibboleth.oidc.IncludedSignatureAlgorithms')}"
+ p:excludedAlgorithms="#{getObject('shibboleth.oidc.ExcludedSignatureAlgorithms')}" />
+
+ <bean id="shibboleth.oidc.BasicSignatureSigningConfiguration" abstract="true"
+ class="net.shibboleth.oidc.security.jose.impl.BasicSignatureSigningConfiguration"
+ p:includedAlgorithms="#{getObject('shibboleth.oidc.IncludedSignatureAlgorithms')}"
+ p:excludedAlgorithms="#{getObject('shibboleth.oidc.ExcludedSignatureAlgorithms')}" />
+
+ <bean id="shibboleth.oidc.BasicEncryptionConfiguration" abstract="true"
+ class="net.shibboleth.oidc.security.jose.impl.BasicEncryptionConfiguration"
+ p:includedAlgorithms="#{getObject('shibboleth.oidc.IncludedEncryptionAlgorithms')}"
+ p:excludedAlgorithms="#{getObject('shibboleth.oidc.ExcludedEncryptionAlgorithms')}" />
+
+ <bean id="shibboleth.oidc.BasicDecryptionConfiguration" abstract="true"
+ class="net.shibboleth.oidc.security.jose.impl.BasicDecryptionConfiguration"
+ p:includedAlgorithms="#{getObject('shibboleth.oidc.IncludedEncryptionAlgorithms')}"
+ p:excludedAlgorithms="#{getObject('shibboleth.oidc.ExcludedEncryptionAlgorithms')}" />
+
+ <bean id="AbstractOIDCProfile" abstract="true"
+ p:securityConfiguration-ref="%{idp.security.oidc.config:shibboleth.oidc.DefaultSecurityConfiguration}" />
+
+ <bean id="AbstractOIDCSSOProfile" parent="AbstractOIDCProfile" abstract="true"
+ p:issuer="#{getObject('shibboleth.oidc.issuer')}"
+ p:tokenEndpointAuthMethods="%{idp.oidc.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}"
+ p:claimsValidator="#{getObject('DefaultJWTClaimsValidator')}"
+ p:encryptionOptional="%{idp.oidc.encryptionOptional:true}"
+ p:forcePKCE="%{idp.oidc.forcePKCE:false}"
+ p:allowPKCEPlain="%{idp.oidc.allowPKCEPlain:false}"
+ p:iDTokenLifetime="%{idp.oidc.idToken.defaultLifetime:PT1H}"
+ p:accessTokenType="%{idp.oauth2.accessToken.type:}"
+ p:accessTokenLifetime="%{idp.oidc.accessToken.defaultLifetime:PT10M}"
+ p:refreshTokenType="%{idp.oauth2.refreshToken.type:}"
+ p:refreshTokenTimeout="%{idp.oidc.refreshToken.defaultTimeout:PT2H}"
+ p:refreshTokenChainLifetime="%{idp.oidc.refreshToken.defaultChainLifetime:PT2H}"
+ p:alwaysIncludedAttributes="%{idp.oidc.alwaysIncludedAttributes:}"
+ p:tokenEndpointAuthMethod="%{idp.authn.oidc.rp.client.authenticationMethod:client_secret_basic}"
+ p:useTargetedEndpointAsJWTAudience="%{idp.oauth2.jwtAuth.targetedEndpointAsJWTAudience:true}"
+ p:requireSingleJWTAudience="%{idp.oauth2.jwtAuth.requireSingleJWTAudience:false}"
+ p:clientId="#{%{idp.authn.oidc.rp.provider.discoveryRequired:false} == true ? null : '%{idp.authn.oidc.rp.client.clientId:}'}"
+ p:clientCredential="#{%{idp.authn.oidc.rp.provider.discoveryRequired:false} == true ? {null} : getObject('shibboleth.authn.oidc.rp.DefaultCredential')}"
+ p:unregisteredClientPolicy="#{getObject('shibboleth.oidc.DefaultUnregisteredClientPolicy')}"
+ p:dpopProofClaimsValidator="#{getObject('DefaultDPoPProofClaimsValidator')}"
+ p:dpopProofSignatureValidationConfiguration="#{getObject('DPoPSignatureValidationConfiguration')}"
+ p:dpopProofNonceGenerator="#{getObject('DefaultOAuth2DPoPNonceGenerator')}"
+ p:strictScopeValidation="%{idp.oidc.strictScopeValidation:false}"/>
+
+ <bean id="OIDC.SSO" parent="AbstractOIDCSSOProfile" lazy-init="true"
+ class="net.shibboleth.oidc.profile.config.impl.DefaultOIDCAuthorizationConfiguration"
+ p:authorizeCodeLifetime="%{idp.oidc.authorizeCode.defaultLifetime:PT5M}"
+ p:encodeConsentInTokens="%{idp.oidc.encodeConsentInTokens:false}"
+ p:encodedAttributes="%{idp.oidc.encodedAttributes:%{idp.oidc.embeddedAttributes:}}"
+ p:deniedUserInfoAttributes="%{idp.oidc.deniedUserInfoAttributes:}"
+ p:httpRequestMethod="%{idp.authn.oidc.rp.httpRequestMethod:GET}"
+ p:retrieveUserInfoEndpointClaims="%{idp.authn.oidc.rp.client.userinfo.enabled:true}"
+ p:redirectUriOverride="%{idp.authn.oidc.rp.client.redirectURI:#{null}}"
+ p:encryptRequestObject="%{idp.oidc.requestobject.encrypted:false}"
+ p:signRequestObject="%{idp.oidc.requestobject.signed:true}"
+ p:useRequestObject="%{idp.oidc.requestobject.used:false}"
+ p:responseMode="%{idp.authn.oidc.rp.client.responseMode:#{null}}"
+ p:tlsServerValidationSufficient="%{idp.authn.oidc.rp.client.idtoken.tlsServerValidationOnly:false}"
+ p:userInfoHttpRequestMethod="%{idp.authn.oidc.rp.client.userinfo.httpRequestMethod:GET}"
+ p:scopes="%{idp.authn.oidc.rp.client.scopes:#{null}}"
+ p:responseModes="%{idp.oauth2.responseModes:}"
+ p:requireAuthenticationRequestPredicate-ref="%{idp.oauth2.requireAuthenticationRequestPredicate:shibboleth.Conditions.TRUE}">
+ <property name="forceAuthnPredicate">
+ <bean class="net.shibboleth.idp.saml.profile.config.logic.ProxyAwareForceAuthnPredicate" />
+ </property>
+ <property name="defaultAuthenticationMethodsLookupStrategy">
+ <bean
+ class="net.shibboleth.oidc.profile.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassRequestLookupFunction"
+ p:mappings="#{getObject('shibboleth.oidc.PrincipalProxyRequestMappings')}" />
+ </property>
+ <property name="authenticationContextClassReferenceTranslationStrategyLookupStrategy">
+ <bean
+ class="net.shibboleth.oidc.profile.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction$LookupFunctionWrapper">
+ <constructor-arg>
+ <bean class="net.shibboleth.oidc.profile.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction"
+ c:mappings="#{getObject('shibboleth.oidc.PrincipalProxyResponseMappings')}"/>
+ </constructor-arg>
+ </bean>
+ </property>
+ <property name="authenticationMethodsReferencesTranslationStrategyLookupStrategy">
+ <bean
+ class="net.shibboleth.oidc.profile.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction$LookupFunctionWrapper">
+ <constructor-arg>
+ <bean class="net.shibboleth.oidc.profile.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction"
+ c:mappings="#{getObject('shibboleth.oidc.PrincipalProxyResponseMappings')}"/>
+ </constructor-arg>
+ </bean>
+ </property>
+ </bean>
+
+ <bean id="shibboleth.oidc.DefaultSecurityConfiguration"
+ class="net.shibboleth.oidc.profile.config.JSONSecurityConfiguration" c:clockSkew="%{idp.policy.clockSkew:PT1M}">
+ <constructor-arg name="idGenerator">
+ <bean
+ class="net.shibboleth.shared.security.IdentifierGenerationStrategy" factory-method="getInstance">
+ <constructor-arg>
+ <util:constant
+ static-field="net.shibboleth.shared.security.IdentifierGenerationStrategy.ProviderType.SECURE" />
+ </constructor-arg>
+ </bean>
+ </constructor-arg>
+ <property name="jwtSignatureSigningConfiguration">
+ <ref bean="#{'%{idp.oidc.signing.config:shibboleth.oidc.SigningConfiguration}'.trim()}" />
+ </property>
+ <property name="jwtEncryptionConfiguration">
+ <ref bean="#{'%{idp.oidc.encryption.config:shibboleth.oidc.EncryptionConfiguration}'.trim()}" />
+ </property>
+ <property name="jwtDecryptionConfiguration">
+ <ref bean="#{'%{idp.oidc.decryption.config:shibboleth.oidc.DecryptionConfiguration}'.trim()}" />
+ </property>
+ <property name="jwtSignatureValidationConfiguration">
+ <ref bean="#{'%{idp.oidc.validation.config:shibboleth.oidc.SignatureValidationConfiguration}'.trim()}" />
+ </property>
+ </bean>
+
+ <bean id="shibboleth.oidc.SigningConfiguration"
+ parent="shibboleth.oidc.BasicSignatureSigningConfiguration"
+ p:signingCredentials-ref="shibboleth.oidc.SigningCredentialsFactory">
+ <property name="signatureAlgorithms">
+ <list>
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_RS_256" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_RS_384" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_RS_512" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_HS_256" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_HS_384" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_HS_512" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_ES_256" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_ES_384" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_ES_512" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_PS_256" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_PS_384" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_PS_512" />
+ </list>
+ </property>
+ </bean>
+
+ <bean id="shibboleth.oidc.EncryptionConfiguration" parent="shibboleth.oidc.BasicEncryptionConfiguration"
+ p:KEKCredentialResolver-ref="defaultOIDCKeyEncryptionCredentialResolver"
+ p:contentEncryptionKeyCredentialResolver-ref="defaultOIDCContentEncryptionKeyCredentialResolver">
+ <property name="keyTransportEncryptionAlgorithms">
+ <list>
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_RSA_1_5" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_RSA_OAEP" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_RSA_OAEP_256" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_RSA_OAEP_384" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_RSA_OAEP_512" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_128_KW" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_192_KW" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_256_KW" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_128_GCM_KW" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_192_GCM_KW" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_AES_256_GCM_KW" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_ECDH_ES" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_ECDH_ES_AES_128_KW" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_ECDH_ES_AES_192_KW" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.KeyManagementConstants.ALGO_ID_ALG_ECDH_ES_AES_256_KW" />
+ </list>
+ </property>
+ <property name="dataEncryptionAlgorithms">
+ <list>
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A128CBC_HS256" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A192CBC_HS384" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A256CBC_HS512" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A128GCM" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A192GCM" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.EncryptionConstants.ALGO_ID_ENC_ALG_A256GCM" />
+ </list>
+ </property>
+ </bean>
+
+ <bean id="shibboleth.oidc.SigningCredentialsFactory"
+ class="net.shibboleth.oidc.profile.config.CredentialsListFactory"
+ c:_0="#{getObject('shibboleth.oidc.SigningCredentials')}" />
+
+ <bean id="defaultOIDCKeyEncryptionCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
+ <constructor-arg>
+ <list>
+ <!-- Used by the OP -->
+ <bean id="ClientInformationCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ClientInformationCredentialResolver"
+ c:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache"
+ c:keyFetchInterval="%{idp.oidc.provider.keyfetch.interval:PT30M}"/>
+ <!-- Used by the RP -->
+ <bean id="OIDCProviderMetadataCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ProviderMetadataCredentialResolver"
+ c:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache"
+ c:keyFetchInterval="%{idp.oidc.provider.keyfetch.interval:PT30M}" />
+ <bean id="ClientSecretCriterionCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ClientSecretCriterionCredentialResolver"/>
+ </list>
+ </constructor-arg>
+ </bean>
+
+ <bean id="defaultOIDCContentEncryptionKeyCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
+ <constructor-arg>
+ <list>
+ <!-- Used by the OP -->
+ <bean id="ClientInformationCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ClientInformationCredentialResolver"
+ c:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache"
+ c:keyFetchInterval="%{idp.oidc.provider.keyfetch.interval:PT30M}"/>
+ <!-- Used by the RP -->
+ <bean id="ClientSecretCriterionCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ClientSecretCriterionCredentialResolver"/>
+ </list>
+ </constructor-arg>
+ </bean>
+
+ <bean id="shibboleth.oidc.DecryptionConfiguration"
+ parent="shibboleth.oidc.BasicDecryptionConfiguration"
+ p:KEKCredentialResolver-ref="defaultOIDCKeyDecryptionCredentialResolver"
+ p:contentEncryptionKeyCredentialResolver-ref="defaultOIDCContentDecryptionKeyCredentialResolver">
+ </bean>
+
+ <!--
+ A resolver to public/private key encryption keys global to the RP
+ -->
+ <bean id="defaultOIDCKeyDecryptionCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
+ <constructor-arg>
+ <list>
+ <bean class="net.shibboleth.oidc.security.credential.impl.LocalJOSEObjectCredentialResolver">
+ <constructor-arg name="localCredentialResolver">
+ <bean
+ class="net.shibboleth.oidc.security.credential.impl.CollectionJOSEObjectCredentialResolver"
+ c:credentials-ref="shibboleth.oidc.EncryptionCredentials" />
+ </constructor-arg>
+ </bean>
+ <!-- Used by the OP -->
+ <bean id="ClientInformationCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ClientInformationCredentialResolver"
+ c:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache"
+ c:keyFetchInterval="%{idp.oidc.provider.keyfetch.interval:PT30M}"/>
+ <!-- Used by the RP -->
+ <bean id="CriterionCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ClientSecretCriterionCredentialResolver"/>
+ </list>
+ </constructor-arg>
+ </bean>
+
+ <bean id="defaultOIDCContentDecryptionKeyCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
+ <constructor-arg>
+ <list>
+ <!-- Used by the OP -->
+ <bean id="ClientInformationCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ClientInformationCredentialResolver"
+ c:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache"
+ c:keyFetchInterval="%{idp.oidc.provider.keyfetch.interval:PT30M}"/>
+ <!-- Used by the RP -->
+ <bean id="CriterionCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ClientSecretCriterionCredentialResolver"/>
+ </list>
+ </constructor-arg>
+ </bean>
+
+ <bean id="shibboleth.oidc.SignatureValidationConfiguration"
+ parent="shibboleth.oidc.BasicSignatureValidationConfiguration"
+ p:signatureTrustEngine-ref="ExplicitKeySignedJWTTrustEngine"/>
+
+
+ <bean id="ExplicitKeySignedJWTTrustEngine"
+ class="net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine"
+ c:resolver-ref="defaultSignedJWTTrustedCredentialResolver"
+ c:JOSEObjectResolver-ref="defaultSignedJWTJOSEHeaderCredentialResolver" />
+
+ <!-- A resolver for resolving 'untrusted' credentials out of the JOSE header of JWTs -->
+ <bean id="defaultSignedJWTJOSEHeaderCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver" />
+
+ <!-- A resolver for resolving trusted credentials to match against those resolved from the JWT -->
+ <bean id="defaultSignedJWTTrustedCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
+ <constructor-arg>
+ <list>
+ <!-- Used by the OP -->
+ <bean id="ClientInformationCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ClientInformationCredentialResolver"
+ c:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache"
+ c:keyFetchInterval="%{idp.oidc.provider.keyfetch.interval:PT30M}"/>
+ <!-- Used by the RP -->
+ <bean id="OIDCProviderMetadataCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ProviderMetadataCredentialResolver"
+ c:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache"
+ c:keyFetchInterval="%{idp.oidc.provider.keyfetch.interval:PT30M}"/>
+ <bean id="CriterionCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ClientSecretCriterionCredentialResolver"/>
+ </list>
+ </constructor-arg>
+ </bean>
+
</beans>
diff --git a/sp-oidc-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/rp/oidc-credentials.xml b/sp-oidc-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/rp/oidc-credentials.xml
deleted file mode 100644
index 7f1daad..0000000
--- a/sp-oidc-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/rp/oidc-credentials.xml
+++ /dev/null
@@ -1,47 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
- xmlns:context="http://www.springframework.org/schema/context"
- xmlns:util="http://www.springframework.org/schema/util"
- xmlns:p="http://www.springframework.org/schema/p"
- xmlns:c="http://www.springframework.org/schema/c"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-
- default-init-method="initialize"
- default-destroy-method="destroy">
-
- <!--
- This defines the signing and encryption key and certificate pairs referenced by your agent/application
- configuration. You don't normally need to touch this, unless you have advanced requirements such as
- supporting multiple sets of keys for different IdPs, in which case you may want to define all your
- credentials here for convenience and reference them as needed.
- -->
-
- <!-- Your SP's default signing key, set via property file. -->
- <bean id="shibboleth.DefaultSigningCredential" parent="shibboleth.BasicX509CredentialFactoryBean"
- p:privateKeyResource="%{sp.saml.signing.key}"
- p:certificateResource="%{sp.saml.signing.cert}" />
-
- <!-- Your SPs default client TLS credential, by default the same as the default signing credential. -->
- <alias alias="shibboleth.DefaultClientTLSCredential" name="shibboleth.DefaultSigningCredential" />
-
- <!-- Your SP's default encryption (really decryption) keys, set via property file. -->
- <util:list id="shibboleth.DefaultEncryptionCredentials">
- <bean parent="shibboleth.BasicX509CredentialFactoryBean"
- p:privateKeyResource="%{sp.saml.encryption.key}"
- p:certificateResource="%{sp.saml.encryption.cert}" />
-
- <!--
- For key rollover, uncomment and point to your original keypair, and use the one above
- to point to your new keypair. Once metadata has propagated, comment this one out again.
- -->
- <!--
- <bean parent="shibboleth.BasicX509CredentialFactoryBean"
- p:privateKeyResource="%{sp.saml.encryption.key.2}"
- p:certificateResource="%{sp.saml.encryption.cert.2}" />
- -->
- </util:list>
-
-</beans>
diff --git a/sp-oidc-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/rp/oidc.properties b/sp-oidc-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/rp/oidc.properties
deleted file mode 100644
index 0e5a47d..0000000
--- a/sp-oidc-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/rp/oidc.properties
+++ /dev/null
@@ -1,2 +0,0 @@
-# OIDC-specific RP settings
-
diff --git a/sp-oidc-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/oidc-credentials.xml b/sp-oidc-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/oidc-credentials.xml
new file mode 100644
index 0000000..d33263a
--- /dev/null
+++ b/sp-oidc-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/oidc-credentials.xml
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:context="http://www.springframework.org/schema/context"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:c="http://www.springframework.org/schema/c"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+
+ default-init-method="initialize"
+ default-destroy-method="destroy">
+
+ <!--
+ This defines the signing and encryption key and certificate pairs referenced by your agent/application
+ configuration. You don't normally need to touch this, unless you have advanced requirements such as
+ supporting multiple sets of keys for different IdPs, in which case you may want to define all your
+ credentials here for convenience and reference them as needed.
+ -->
+
+
+ <!--
+ This file contains default OIDC signing credentials. This file should be imported into credentials.xml.
+ -->
+
+ <bean id="shibboleth.oidc.DefaultRSSigningCredential" parent="shibboleth.oidc.JWKCredential"
+ p:resource="%{sp.oidc.signing.rs.key:#{null}}" p:throwIfNull="false" />
+
+ <bean id="shibboleth.oidc.DefaultESSigningCredential" parent="shibboleth.oidc.JWKCredential"
+ p:resource="%{sp.oidc.signing.es.key:#{null}}" p:throwIfNull="false" />
+
+ <bean id="shibboleth.oidc.DefaultRSAEncryptionCredential" parent="shibboleth.oidc.JWKCredential"
+ p:resource="%{sp.oidc.signing.rsa.enc.key:#{null}}" p:throwIfNull="false" />
+
+ <!--
+ Lists ALL of your OP's response signing credentials for the default security configuration.
+ If you define additional signing credentials make sure to include them within this list.
+ -->
+ <util:list id="shibboleth.oidc.SigningCredentials">
+ <ref bean="shibboleth.oidc.DefaultRSSigningCredential" />
+ <ref bean="shibboleth.oidc.DefaultESSigningCredential" />
+ </util:list>
+
+ <!--
+ Lists ALL of your OP's request decryption credentials for the default security configuration.
+ If you define additional decryption credentials make sure to include them within this list.
+ -->
+ <util:list id="shibboleth.oidc.EncryptionCredentials">
+ <ref bean="shibboleth.oidc.DefaultRSAEncryptionCredential" />
+ </util:list>
+
+ <!--
+ If you need to publish a key set different from shibboleth.oidc.EncryptionCredentials, define
+ a list bean named "shibboleth.oidc.EncryptionCredentialsToPublish".
+ -->
+
+ <!-- Example of two active encryption credentials, but only publishing the second before removing from use. -->
+ <!--
+ <util:list id="shibboleth.oidc.EncryptionCredentialsToPublish">
+ <ref bean="shibboleth.oidc.OnlyNewDefaultRSAEncryptionCredential" />
+ </util:list>
+ -->
+
+ <!--
+ If you need to publish a key set different from shibboleth.oidc.SigningCredentials, define
+ a list bean named "shibboleth.oidc.SigningCredentialsToPublish".
+ -->
+
+ <!-- Example of publishing two signing credentials, before active use. -->
+ <!--
+ <util:list id="shibboleth.oidc.SigningCredentialsToPublish">
+ <ref bean="shibboleth.oidc.DefaultRSSigningCredential" />
+ <ref bean="shibboleth.oidc.DefaultESSigningCredential" />
+ <ref bean="shibboleth.oidc.UpcomingDefaultRSSigningCredential" />
+ </util:list>
+ -->
+
+</beans>
diff --git a/sp-oidc-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/oidc.properties b/sp-oidc-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/oidc.properties
new file mode 100644
index 0000000..bc3174e
--- /dev/null
+++ b/sp-oidc-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/oidc.properties
@@ -0,0 +1,19 @@
+# OIDC-specific RP settings
+
+# Settings for RP public/private signing and encryption key(s)
+# During decryption key rollover, point the ".2" properties at a second
+# keypair, uncomment in credentials.xml, then publish it in your metadata.
+
+## TODO, should these be different credentials than the SAML specific SP ones? Or are they for the agent comms...not sure
+#sp.oidc.signing.key = %{idp.home}/credentials/sp/sp-signing.key
+#sp.oidc.signing.cert = %{idp.home}/credentials/sp/sp-signing.crt
+#sp.oidc.encryption.key = %{idp.home}/credentials/sp/sp-encryption.key
+#sp.oidc.encryption.cert = %{idp.home}/credentials/sp/sp-encryption.crt
+
+sp.oidc.signing.rs.key = %{idp.home}/credentials/sp/sp-signing-rs.jwk
+sp.oidc.signing.es.key = %{idp.home}/credentials/sp/sp-signing-es.jwk
+sp.oidc.signing.rsa.enc.key = %{idp.home}/credentials/sp/sp-encryption-rsa.jwk
+
+#sp.oidc.encryption.key.2 = %{idp.home}/credentials/sp/sp-encryption-old.key
+#sp.oidc.encryption.cert.2 = %{idp.home}/credentials/sp/sp-encryption-old.crt
+
diff --git a/sp-oidc-conf-impl/src/main/resources/net/shibboleth/sp/oidc/conf/module.properties b/sp-oidc-conf-impl/src/main/resources/net/shibboleth/sp/oidc/conf/module.properties
index 048b2ed..8f320ac 100644
--- a/sp-oidc-conf-impl/src/main/resources/net/shibboleth/sp/oidc/conf/module.properties
+++ b/sp-oidc-conf-impl/src/main/resources/net/shibboleth/sp/oidc/conf/module.properties
@@ -10,8 +10,8 @@ sp.OIDC.name = SP OIDC Protocol Support
sp.OIDC.desc = OIDC protocol plugin for SP processing hub plugin.
sp.OIDC.url = /SP/OIDC
-sp.OIDC.1.src = /net/shibboleth/idp/module/conf/rp/oidc.properties
-sp.OIDC.1.dest = conf/rp/oidc.properties
+sp.OIDC.1.src = /net/shibboleth/idp/module/conf/sp/oidc.properties
+sp.OIDC.1.dest = conf/sp/oidc.properties
-sp.OIDC.2.src = /net/shibboleth/idp/module/conf/rp/oidc-credentials.xml
-sp.OIDC.2.dest = conf/rp/oidc-credentials.xml
+sp.OIDC.2.src = /net/shibboleth/idp/module/conf/sp/oidc-credentials.xml
+sp.OIDC.2.dest = conf/sp/oidc-credentials.xml
diff --git a/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCAuthenticationFlowTest.java b/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCAuthenticationFlowTest.java
new file mode 100644
index 0000000..4a23852
--- /dev/null
+++ b/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCAuthenticationFlowTest.java
@@ -0,0 +1,87 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.sp.oidc.flows;
+
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+
+import javax.annotation.Nonnull;
+
+import org.springframework.test.context.ContextConfiguration;
+import org.springframework.test.context.web.WebAppConfiguration;
+import org.springframework.webflow.executor.FlowExecutionResult;
+import org.testng.annotations.Test;
+
+import net.shibboleth.sp.ddf.DDF;
+import net.shibboleth.sp.flows.AbstractSPFlowTest;
+import net.shibboleth.sp.messaging.RemotedHttpServletRequest;
+import net.shibboleth.sp.profile.InitiatorConstants;
+import net.shibboleth.sp.profile.SPConstants;
+
+/**
+ *
+ */
+ at ContextConfiguration(
+ locations = {
+ "classpath:/net/shibboleth/sp/oidc-test-beans.xml", },
+ initializers = {
+ TestSPOIDCEnvironmentApplicationContextInitializer.class,
+ }
+ )
+ at WebAppConfiguration
+public class OIDCAuthenticationFlowTest extends AbstractSPFlowTest {
+
+ /** Flow ID. */
+ @Nonnull public static final String FLOW_ID = "sp/session-initiator";
+
+ /** Resource URL. */
+ @Nonnull public static final byte[] RESOURCE_URL = "https://sp.example.org/secure".getBytes(StandardCharsets.UTF_8);
+
+ /** ACS URL. */
+ @Nonnull public static final String RESPONSE_URL = "https://sp.example.org/Shibboleth.sso/ACS";
+
+ /** POST ACS URL. */
+ @Nonnull public static final String POST_RESPONSE_URL = "https://sp.example.org/Shibboleth.sso/SAML2/POST";
+
+ /** Artifact ACS URL. */
+ @Nonnull public static final String ARTIFACT_RESPONSE_URL = "https://sp.example.org/Shibboleth.sso/SAML2/Artifact";
+
+ /** Constructor. */
+ protected OIDCAuthenticationFlowTest() {
+ super(FLOW_ID);
+ }
+
+ /**
+ * Basic flow test, mainly for TDD.
+ *
+ * @throws IOException on error
+ */
+ @Test
+ public void testFlow() throws IOException {
+ setDefaultAuth();
+
+ final DDF input = new DDF(null).structure();
+ input.addmember(RemotedHttpServletRequest.STRUCTURE_NAME).structure();
+ input.addmember(InitiatorConstants.RESPONSE_URL).string(RESPONSE_URL);
+ input.addmember(SPConstants.TARGET).unsafe_string(RESOURCE_URL);
+ setApplicationRequest("no-metadata", input);
+
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ assertFlowExecutionResult(result, FLOW_ID);
+ assertFlowExecutionOutcome(result.getOutcome());
+ //assertOutputMessageEvent(result, AuthnEventIds.NO_POTENTIAL_FLOW);
+ }
+
+}
diff --git a/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/TestSPOIDCEnvironmentApplicationContextInitializer.java b/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/TestSPOIDCEnvironmentApplicationContextInitializer.java
new file mode 100644
index 0000000..c4a67a2
--- /dev/null
+++ b/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/TestSPOIDCEnvironmentApplicationContextInitializer.java
@@ -0,0 +1,55 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.sp.oidc.flows;
+
+import javax.annotation.Nonnull;
+
+import org.slf4j.Logger;
+import org.springframework.context.ApplicationContextInitializer;
+import org.springframework.context.ConfigurableApplicationContext;
+import org.springframework.core.Ordered;
+import org.springframework.core.annotation.Order;
+import org.springframework.mock.env.MockPropertySource;
+
+import net.shibboleth.shared.primitive.LoggerFactory;
+
+/**
+ * An {@link ApplicationContextInitializer} which prepends properties.
+ *
+ * <p>This needs to include the original IdP-test-layer properties and has to be
+ * set to {@link Ordered#LOWEST_PRECEDENCE} or things blow up.</p>
+ */
+ at Order(Ordered.LOWEST_PRECEDENCE)
+public class TestSPOIDCEnvironmentApplicationContextInitializer
+ implements ApplicationContextInitializer<ConfigurableApplicationContext> {
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(TestSPOIDCEnvironmentApplicationContextInitializer.class);
+
+ /** {@inheritDoc} */
+ @Override public void initialize(@Nonnull final ConfigurableApplicationContext applicationContext) {
+ final MockPropertySource mock = new MockPropertySource();
+ mock.setProperty("idp.home", "classpath:/net/shibboleth/idp/module");
+ mock.setProperty("idp.webflows", "classpath*:/flows");
+ mock.setProperty("sp.service.agents.resources", "test.sp.oidc.AgentResolverResources");
+ mock.setProperty("sp.stateToken.Manager","shibboleth.CookieStateTokenManager");
+ //mock.setProperty("idp.service.logging.resource", "/logback-webauthn-flow-test.xml");
+ mock.setProperty("idp.additionalProperties",
+ "/conf/ldap.properties, /conf/saml-nameid.properties, /conf/services.properties, /conf/admin/admin.properties, /conf/authn/authn.properties, /conf/c14n/subject-c14n.properties, /credentials/secrets.properties, /conf/sp/sp.properties, /conf/sp/oidc.properties");
+ applicationContext.getEnvironment().getPropertySources().addFirst(mock);
+ log.info("Prepending properties '{}'", mock.getSource());
+ }
+
+}
\ No newline at end of file
diff --git a/sp-oidc-conf-impl/src/test/resources/logback-webauthn-flow-test.xml b/sp-oidc-conf-impl/src/test/resources/logback-webauthn-flow-test.xml
new file mode 100644
index 0000000..d71e445
--- /dev/null
+++ b/sp-oidc-conf-impl/src/test/resources/logback-webauthn-flow-test.xml
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<configuration>
+
+ <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
+ <encoder class="ch.qos.logback.classic.encoder.PatternLayoutEncoder">
+ <pattern>%level [%logger:%line] - %msg%n</pattern>
+ <charset>UTF-8</charset>
+ </encoder>
+ </appender>
+
+ <root>
+ <level value="WARN" />
+ <appender-ref ref="STDOUT" />
+ </root>
+
+ <logger name="net.shibboleth.idp.plugin.authn" level="TRACE" additivity="false">
+ <appender-ref ref="STDOUT" />
+ </logger>
+
+ <logger name="org.springframework.webflow" level="INFO" additivity="false">
+ <appender-ref ref="STDOUT" />
+ </logger>
+
+</configuration>
\ No newline at end of file
diff --git a/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/attributes/default-rules.xml b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/attributes/default-rules.xml
index 96cb402..92a138e 100644
--- a/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/attributes/default-rules.xml
+++ b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/attributes/default-rules.xml
@@ -26,6 +26,7 @@
<import resource="schac.xml" />
<import resource="samlSubject.xml" />
- <import resource="nameid-testing.xml" />
+ <!-- TODO: check nameid -->
+ <!-- <import resource="nameid-testing.xml" /> -->
</beans>
diff --git a/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/agents.xml b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/agents.xml
index 849e885..a2a46f2 100644
--- a/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/agents.xml
+++ b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/agents.xml
@@ -46,7 +46,8 @@
<util:list id="shibboleth.DefaultProfileConfigurations">
<!-- Your profiles here. -->
- <bean parent="SAML2.SSO" p:checkAddress="false" p:checkInResponseTo="false" />
+ <!-- <bean parent="OIDC.SSO" p:checkAddress="false" p:checkInResponseTo="false" /> -->
+ <bean parent="OIDC.SSO"/>
</util:list>
@@ -78,6 +79,6 @@
</util:list>
- <import resource="saml-credentials.xml" />
+ <import resource="oidc-credentials.xml" />
</beans>
diff --git a/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/saml-test-agents.xml b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/oidc-test-agents.xml
similarity index 87%
rename from sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/saml-test-agents.xml
rename to sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/oidc-test-agents.xml
index 8cf2702..d8656cb 100644
--- a/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/saml-test-agents.xml
+++ b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/oidc-test-agents.xml
@@ -13,10 +13,10 @@
default-destroy-method="destroy">
<!--
- This file is used in the sp-saml-conf-impl unit tests by overriding the AgentResolver service resources.
+ This file is used in the sp-oidc-conf-impl unit tests by overriding the AgentResolver service resources.
-->
- <import resource="saml-credentials.xml" />
+ <import resource="oidc-credentials.xml" />
<bean id="testsp.example.org" parent="shibboleth.Agent" p:sharedSecrets="foo">
<property name="applications">
@@ -64,21 +64,23 @@
</util:list>
<util:list id="test.ProfileConfigurations">
- <ref bean="SAML2.SSO" />
- <ref bean="SAML2.ECP" />
- <ref bean="SAML2.Logout" />
+ <ref bean="OIDC.SSO" />
+<!-- <ref bean="SAML2.ECP" />
+ <ref bean="SAML2.Logout" /> -->
</util:list>
<util:list id="test.responseBindingProfileConfigurations">
- <bean parent="SAML2.SSO" p:responseBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" />
- <ref bean="SAML2.ECP" />
- <ref bean="SAML2.Logout" />
+ <!-- <bean parent="OIDC.SSO" p:responseBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" /> -->
+ <bean parent="OIDC.SSO"/>
+<!-- <ref bean="SAML2.ECP" />
+ <ref bean="SAML2.Logout" /> -->
</util:list>
<util:list id="test.featureBlockingProfileConfigurations">
- <bean parent="SAML2.SSO" p:disallowedFeatures="0x1F" />
- <ref bean="SAML2.ECP" />
- <ref bean="SAML2.Logout" />
+ <!-- <bean parent="OIDC.SSO" p:disallowedFeatures="0x1F" /> -->
+ <bean parent="OIDC.SSO" />
+<!-- <ref bean="SAML2.ECP" />
+ <ref bean="SAML2.Logout" /> -->
</util:list>
<!-- ============ Profile defaults ============ -->
@@ -87,7 +89,7 @@
<util:list id="shibboleth.DefaultProfileConfigurations">
<!-- Your profiles here. -->
- <ref bean="SAML2.SSO" />
+ <ref bean="OIDC.SSO" />
</util:list>
diff --git a/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/credentials/sp/sp-encryption-rsa.jwk b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/credentials/sp/sp-encryption-rsa.jwk
new file mode 100644
index 0000000..0c21110
--- /dev/null
+++ b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/credentials/sp/sp-encryption-rsa.jwk
@@ -0,0 +1,13 @@
+{
+ "p": "5wVHO2-yeyReB-w_pUr-xzrY6tMS54rGlyUjOPiuUJxJYEHHOr1CqzuW1dUMkZDuec8ggF_rNd51hu6UChKsW6WLfLjSwVPx_ompBMmYVShv8PgtnwYL1d9PMqk2ibB_GaRLlM16e9ynqFaZXBNnbwl3qHv6WYu6nABPI54zoGs",
+ "kty": "RSA",
+ "q": "yzwGoBHkLWLqIQ_DdY2jimOEqgKrzPau41wHAMQXcyzGavayCgsc6r6o9_RDKkgwFnpXk-mmcZr-osqapRwL8LaYtoBBMXTRCFd02N1IqkxmXRjq3pu7WFSNsHWy0GkSdE626fpJklUjh4TLFfOSBRkzKy7E6cj-vyhzqmrgZAU",
+ "d": "bPsmY1pD0Wr5nj_Optd6hkoM5ANXKVeM2rMKQ2_n7qg6qA4Li-nb_jgyAaiomB2TYAjtJvY804Cc9lhsoXyN0o8NJh8YpI4_59oKJA-L_CupmeZxI9Jo7D4WCrh2HVIjCokqyDjd30aYdb_R9x1ACmE6cfwTxY0TVAhFaT9rhCVZHc6I8niw9kbevmpMZbLwR6WDvdivPBto6BGLXzInxf2s22lGcetP1m2Trj15hW5oOsUDTKXosKWZrs6-9qGO9Uq4JEzhdVdUOQvkoujrT-G9-hbscvDO2-KXJ6a3qz4SDYFCGoWB0QhsLmHGLtBOUvJRiEuztjAy-L_eyigLWQ",
+ "e": "AQAB",
+ "use": "enc",
+ "kid": "defaultRSAEnc",
+ "qi": "X8a2QwIr5q94V9QyAsArVijyICSrEsdT5Zfpyoz7Eyhd2VoAyA74WiUbcFElbHNbJOKmvHzp9les4o3BCpsTYwUyRdlB-npL_tEpp7fdIj8I3EhWfspJwT1EfLtJakGwoa6v0KpOmEzzR9mCwKmSnKfhF3aA1S-Hch1eEiV8qm8",
+ "dp": "vJNaafHrRwmQl_cInOxyvD4VAtn4_HgTUx1FeyPDZpmsa55F-nSzDwM9RJ77-3bKszOX3DJv1TEZzmLBBNfpSYYALnbP0m-rgZLtHLNSXXD8rz5mPwC4eIQoKbpmgk5H8a5i47w21xRu5sKJvNc5_zFDM4y_9ohQczbtYq2ohrE",
+ "dq": "fyfzTTtkdDErI7xlIquX4wIZAvXg38CH86CkkQofUeR10H7BLh993DGmLl0ZmN7Jl4a8PMM3bGT5ZIk28I73uYfFTIo6P-NC1eFCLl1lFYfvk9f_O4BcWwusCvfZBSR4c2S8dPAwD-pM7IFdP0LB3YbCyQXeFhe3q4p3s-xisLE",
+ "n": "t2das2ad4qJFs9irOR6s4xYF6rCGZb1KkTZqu-C0enTFWDr6CZFCN645esS2n20-wbPzMZTcOxFTJN4vRwzEpz2t4DKwNmxMX8CXBmujY0EO-oY9888zoKy4M17KtJuWxcBw3djmcuy3srHsExx3Fj9IsYh2SO8vBBEFsj0MajeYi9xhZJv1pqg3HPrEptclIAEcjuIV2QtwJ3MtSPrmXuLV0WfGbJOVEZNS1JsqYLwMOpgnIBp2P2B_Iba4GwI_9FBpQJ486Szmcnf-8khzJwLmawDvIfrwyEspVF48EHgGLfwLOejAivYJKbEIaUtHDEm8fEx_zUJOp9sk7UvuFw"
+}
diff --git a/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/credentials/sp/sp-signing-es.jwk b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/credentials/sp/sp-signing-es.jwk
new file mode 100644
index 0000000..1922fdd
--- /dev/null
+++ b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/credentials/sp/sp-signing-es.jwk
@@ -0,0 +1,9 @@
+{
+ "kty": "EC",
+ "d": "QWtFyZCtU1LV6P6WRS-mDusOW1kiAT7IgedxGLn67fU",
+ "use": "sig",
+ "crv": "P-256",
+ "kid": "defaultECSign",
+ "x": "PwvfwhB26DLjKcq5P0jdsKINNb6rjO8H8TWpSfLzmP8",
+ "y": "mlPDVWMGI6srvnsOpRrXHKzwxgQF-yA9R-ZdAeAEyGk"
+}
diff --git a/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/credentials/sp/sp-signing-rs.jwk b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/credentials/sp/sp-signing-rs.jwk
new file mode 100644
index 0000000..c8ebcdc
--- /dev/null
+++ b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/credentials/sp/sp-signing-rs.jwk
@@ -0,0 +1,13 @@
+{
+ "p": "3uZuwfDlEJ0CvznRR_jVoF6iNMgz-wvcCX9hxpuz9eT0DtkbBwOz-EtCLcR7yaykWLHVlYscq3SyyTQg91vJ8H4CW_UzKra5yc1FUAKZ3BHgz-EaNBYvvqCXXal29eJWGHlMU6RnUv_OItQaj2tsv9cAYF-vjh9Pf2gfQNAsZ5E",
+ "kty": "RSA",
+ "q": "pKkqFLDZjLMBmRh6HoqFuk3NqihoEvT9z-W0OpwTFWELNgSldNtmJ_RMnxxryiaepnwID6y2ghcXy-lobQnuvABG6RW0yDOBpr3Cl2GQNeBaQ4ubLiEY85NnDl0EmVnG7VqgSVS-HE0w9n4MfRKWRCRfIOSrA-_PdT18qmJ5Zgc",
+ "d": "Pejya5O-L57ePGM1g386iUSrLQf9rs52hD4R9pXGhPNlFlqn3XO20IPwxmtBK5UtoRqfrS4q3xT-eMwlcQILGzMeEKNdORb68QR4wxEVgCS44eQizXwn3M-Hgw4a7QXAb7gCOoFKeRKrxCm4AB9pZYe8Xqj5Em9_b6WZclOUYK-MLpucRjBmOSV-XhhfYYQkrnF3yzPg3lmLEAiaxHhMwzBYm25qpfTsZ2N879O2TKMYKuid5WeyGtjXhoTf5nBDYMCDFQs1K-_IW-HD47DREs6aiUMLpI42N01xWsPqxBcrFm5h_SjJ71YOBpla_GkcdvYyp4gqx__mSy7-LQqQgQ",
+ "e": "AQAB",
+ "use": "sig",
+ "kid": "defaultRSASign",
+ "qi": "iwkNSyRS2Q8d5sRQWRxE_3F8DD2uQ6BJD9sWZL1DxMdIscrHho-AeUepwES_6rN3G3ep6tyaRW_6dKFOc-2v1GcOuB6t5b4zuhBiujZWUtr368Frz2iaC_bLlDSPSU3bJn_tGHU0aFAyoZZYjrg-SUDk4GEjZhnhEst1O81HMHw",
+ "dp": "F6GOdHk5j71VoThb-6lh3JKr17Sx7hefyFH857VyKsuPJFPYDbJSziwMZBXEmej3s3-HCUeqTnMc0T_5jr_odNqnHWCtgAXHRKHCi2z7Kt2qW9-di5Ael7Mm2QMyXXcVcZrKgMOZQK9mB0M9XZ8h9GSy4YTDc-nV38gGKDTpwEE",
+ "dq": "cV2qhD5SOaWQ5xfMFDTo5yDkBU_2f36_NKCAmo2UMfbzYgiG5dKcHcv76NwHdlFqj1L7tdcCfMRrdM_JPrFE9Zj3OUjhg6i6jdM-Iz1frUg-vRxkBblx1VlZ7bCrFu2RoR7xFivLC-81U6_q5z2hyV6FRD9LYtV7rstbhm9wB4c",
+ "n": "j17pty6DFoQNIMJlcpCABcg-r4USeqDGvt_jh4F5tem6sBFaInqzlP5PoCZHWAUmKIcwhUgK1IrHWjrRn3UE7qbkEF40AAm71G3xO5x_9PKoUHIX9-Kqy8gG02-uU00VprPZ0A1cU3x6zA23Efpee_nLKD-bzUaJ_z_fy7lJBW7L8qqO7pGbDAZwc8oOkUiFuC4SpwuJl0njCLSyIUNGI8cAXk3M2qXHyCaFjd5n8AETySxst6Pq4eYtC46WnTqNvw3av7Nk2Y9jekwJKfN5ykfu6f2v3NdkyJjuuQ-Z33bcDNGD7hAdRfoLpjzrCcpcFwqh657exSY_1BSj2AOa9w"
+}
diff --git a/sp-oidc-conf-impl/src/test/resources/net/shibboleth/sp/oidc-test-beans.xml b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/sp/oidc-test-beans.xml
index 02f3ef3..2ee0182 100644
--- a/sp-oidc-conf-impl/src/test/resources/net/shibboleth/sp/oidc-test-beans.xml
+++ b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/sp/oidc-test-beans.xml
@@ -16,8 +16,8 @@
<!-- Used in sp-oidc-conf-impl unit tests for overriding resources and installing dummy creds for signing test data. -->
- <util:list id="test.sp.saml.AgentResolverResources">
- <value>%{idp.home}/conf/sp/saml-test-agents.xml</value>
+ <util:list id="test.sp.oidc.AgentResolverResources">
+ <value>%{idp.home}/conf/sp/oidc-test-agents.xml</value>
</util:list>
<bean id="dummy.idp.X509Certificate" class="net.shibboleth.shared.spring.security.factory.X509CertificateFactoryBean"
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list