[java-idp-plugin-oidc-op-oidfed] branch main updated: Moved entity configuration optional clains lookup strategies to profile configuration
Codeberg
noreply at shibboleth.net
Thu Dec 4 11:46:36 UTC 2025
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-idp-plugin-oidc-op-oidfed.
View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-oidc-op-oidfed/commit/483b529f14a906d2d0874546bda9823984458c06
The following commit(s) were added to refs/heads/main by this push:
new 483b529 Moved entity configuration optional clains lookup strategies to profile configuration
483b529 is described below
commit 483b529f14a906d2d0874546bda9823984458c06
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Thu Dec 4 13:46:08 2025 +0200
Moved entity configuration optional clains lookup strategies to profile configuration
- OIDFED.Configuration p:optionalClaimsLookupStrategies
- Defaults to shibboleth.oidfed.EntityConfigurationClaimsLookupStrategies
- This enables reload via shibboleth.RelyingPartyResolverService
- Also moved 'trust_anchor_hints' claim construction into the same map
- Fixed cached entity configuration expiration time strategy
---
...ionEntityConfigurationProfileConfiguration.java | 14 +++++
...tionalClaimsLookupStrategiesLookupFunction.java | 52 +++++++++++++++++
...ionResponseContainerExpirationTimeStrategy.java | 19 +++---
...ionEntityConfigurationProfileConfiguration.java | 35 +++++++++++
.../profile/impl/BuildEntityConfiguration.java | 68 +++++++++-------------
.../META-INF/net.shibboleth.idp/postconfig.xml | 1 -
.../entity-configuration-beans.xml | 8 +--
.../idp/service/relying-party/postconfig.xml | 11 +++-
.../oidfed/oidfed-entity-configuration-claims.xml | 3 +-
.../oidfed/oidfed-entity-configuration-claims.xml | 3 +-
10 files changed, 150 insertions(+), 64 deletions(-)
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/OIDFederationEntityConfigurationProfileConfiguration.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/OIDFederationEntityConfigurationProfileConfiguration.java
index d40a6f1..ffcd001 100644
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/OIDFederationEntityConfigurationProfileConfiguration.java
+++ b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/OIDFederationEntityConfigurationProfileConfiguration.java
@@ -16,6 +16,8 @@ package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config;
import java.time.Duration;
import java.util.List;
+import java.util.Map;
+import java.util.function.Function;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
@@ -65,4 +67,16 @@ public interface OIDFederationEntityConfigurationProfileConfiguration extends Ov
@ConfigurationSetting(name="entityStatementLifetime")
@Positive @Nonnull Duration getEntityStatementLifetime(@Nullable final ProfileRequestContext profileRequestContext);
+ /**
+ * Get the lookup strategies for optional claims to be included to the entity configuration.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return optional claims to be included to the entity configuration
+ */
+ @ConfigurationSetting(name="optionalClaimsLookupStrategies")
+ @Nonnull @NonnullElements @NotLive @Unmodifiable
+ Map<String,Function<ProfileRequestContext,Object>> getOptionalClaimsLookupStrategies(
+ @Nullable final ProfileRequestContext profileRequestContext);
+
}
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/navigate/OptionalClaimsLookupStrategiesLookupFunction.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/navigate/OptionalClaimsLookupStrategiesLookupFunction.java
new file mode 100644
index 0000000..a973cd0
--- /dev/null
+++ b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/navigate/OptionalClaimsLookupStrategiesLookupFunction.java
@@ -0,0 +1,52 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.navigate;
+
+import java.util.Map;
+import java.util.function.Function;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.OIDFederationEntityConfigurationProfileConfiguration;
+import net.shibboleth.profile.config.ProfileConfiguration;
+import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.profile.context.navigate.AbstractRelyingPartyLookupFunction;
+
+/**
+ * A function that returns optional entity configuration claims lookup strategies from
+ * {@link OIDFederationEntityConfigurationProfileConfiguration} if such a profile is available from a
+ * {@link RelyingPartyContext} obtained via a lookup function, by default a child of the {@link ProfileRequestContext}.
+ *
+ * <p>If a specific setting is unavailable, a null value is returned.</p>
+ */
+public class OptionalClaimsLookupStrategiesLookupFunction extends
+ AbstractRelyingPartyLookupFunction<Map<String,Function<ProfileRequestContext,Object>>> {
+
+ /** {@inheritDoc} */
+ @Override
+ @Nullable public Map<String,Function<ProfileRequestContext,Object>> apply(
+ @Nullable final ProfileRequestContext input) {
+ final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpc != null) {
+ final ProfileConfiguration pc = rpc.getProfileConfig();
+ if (pc instanceof OIDFederationEntityConfigurationProfileConfiguration ofecpc) {
+ return ofecpc.getOptionalClaimsLookupStrategies(input);
+ }
+ }
+ return null;
+ }
+}
\ No newline at end of file
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultEntityConfigurationResponseContainerExpirationTimeStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultEntityConfigurationResponseContainerExpirationTimeStrategy.java
index b0058b5..56275fd 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultEntityConfigurationResponseContainerExpirationTimeStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultEntityConfigurationResponseContainerExpirationTimeStrategy.java
@@ -15,6 +15,9 @@
package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
import java.time.Instant;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
import java.util.Optional;
import java.util.function.Function;
@@ -28,7 +31,7 @@ import net.shibboleth.oidc.metadata.cache.ExpirationTimeContext;
/**
* Default strategy for fetching expiration time for the entity configuration response container. The expiration instant
* is fetched from which is before: the success response message's JWT expiration time or the instant returned by
- * {@link NimbusResponseContainer#getExpirationInstant()}.
+ * {@link NimbusResponseContainer#getExpirationInstant()} or {@link ExpirationTimeContext#getMaxCacheDuration()}.
*/
@ThreadSafe
public class DefaultEntityConfigurationResponseContainerExpirationTimeStrategy
@@ -44,16 +47,12 @@ public class DefaultEntityConfigurationResponseContainerExpirationTimeStrategy
if (container == null || container.getExpirationInstant() == null) {
return contextExpiration;
}
- final Instant containerExpiration = container.getExpirationInstant();
+ final List<Instant> expirations = new ArrayList<>(List.of(contextExpiration, container.getExpirationInstant()));
if (container.getResponse() instanceof FederationEntityConfigurationSuccessResponse successResponse) {
- final Instant jwtExpiration = Optional.ofNullable(
- successResponse.getEntityStatement().getClaimsSet().getExpirationTime())
- .map(date -> date.toInstant())
- .orElse(null);
- return jwtExpiration == null ? containerExpiration :
- jwtExpiration.isBefore(containerExpiration) ? jwtExpiration : containerExpiration;
+ Optional.ofNullable(successResponse.getEntityStatement().getClaimsSet().getExpirationTime())
+ .map(date -> date.toInstant())
+ .ifPresent(instant -> expirations.add(instant));
}
- return containerExpiration;
+ return Collections.min(expirations);
}
-
}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/impl/DefaultOIDFederationEntityConfigurationProfileConfiguration.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/impl/DefaultOIDFederationEntityConfigurationProfileConfiguration.java
index 1031613..d3b542b 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/impl/DefaultOIDFederationEntityConfigurationProfileConfiguration.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/impl/DefaultOIDFederationEntityConfigurationProfileConfiguration.java
@@ -59,6 +59,11 @@ public class DefaultOIDFederationEntityConfigurationProfileConfiguration
private Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
entityStatementClaimsSetManipulationStrategyLookupStrategy;
+ /** Lookup function to supply map of strategies for optional claims to be included in the entity configuration. */
+ @Nonnull
+ private Function<ProfileRequestContext,Map<String,Function<ProfileRequestContext,Object>>>
+ optionalClaimsLookupStrategiesLookupStrategy;
+
/**
* Constructor.
*/
@@ -77,6 +82,7 @@ public class DefaultOIDFederationEntityConfigurationProfileConfiguration
authorityHintsLookupStrategy = FunctionSupport.constant(CollectionSupport.emptyList());
entityStatementLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofHours(24));
entityStatementClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(null);
+ optionalClaimsLookupStrategiesLookupStrategy = FunctionSupport.constant(null);
}
/** {@inheritDoc} */
@@ -197,4 +203,33 @@ public class DefaultOIDFederationEntityConfigurationProfileConfiguration
"Lookup strategy cannot be null");
}
+ /** {@inheritDoc} */
+ @Override
+ @Nullable
+ public Map<String,Function<ProfileRequestContext,Object>> getOptionalClaimsLookupStrategies(
+ @Nullable final ProfileRequestContext profileRequestContext) {
+ return optionalClaimsLookupStrategiesLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Set the lookup strategies for optional claims to be included to the entity configuration.
+ *
+ * @param strategies lookup strategies for optional claims to be included to the entity configuration
+ */
+ public void setOptionalClaimsLookupStrategies(
+ @Nullable final Map<String,Function<ProfileRequestContext,Object>> strategies) {
+ optionalClaimsLookupStrategiesLookupStrategy = FunctionSupport.constant(strategies);
+ }
+
+ /**
+ * Set a lookup strategy for the lookup strategies for optional claims to be included to the entity configuration.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setOptionalClaimsLookupStrategiesLookupStrategy(@Nonnull final
+ Function<ProfileRequestContext,Map<String,Function<ProfileRequestContext,Object>>> strategy) {
+ optionalClaimsLookupStrategiesLookupStrategy = Constraint.isNotNull(strategy,
+ "Lookup strategy cannot be null");
+ }
+
}
\ No newline at end of file
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildEntityConfiguration.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildEntityConfiguration.java
index be1f5b4..0bb793d 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildEntityConfiguration.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildEntityConfiguration.java
@@ -35,11 +35,11 @@ import com.nimbusds.jwt.JWTClaimsSet;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.navigate.AuthorityHintsLookupFunction;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.navigate.EntityStatementLifetimeLookupFunction;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.navigate.OptionalClaimsLookupStrategiesLookupFunction;
import net.shibboleth.idp.profile.IdPEventIds;
import net.shibboleth.oidc.profile.config.navigate.JWTSignatureSigningConfigurationLookupFunction;
import net.shibboleth.oidc.security.CredentialConversionUtil;
import net.shibboleth.oidc.security.jose.SignatureSigningConfiguration;
-import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.component.ComponentInitializationException;
@@ -71,11 +71,9 @@ public class BuildEntityConfiguration extends AbstractBuildEntityStatementAction
/** Strategy used to locate authority hints. */
@Nonnull private Function<ProfileRequestContext,List<String>> authorityHintsLookupStrategy;
- /** Strategy used to locate trust_anchor_hints. */
- @NonnullAfterInit private Function<ProfileRequestContext,List<String>> trustAnchorHintsLookupStrategy;
-
- /** Strategies used to locate values for optional claims. */
- @NonnullAfterInit private Map<String, Function<ProfileRequestContext,Object>> optionalClaimsLookupStrategies;
+ /** Strategy used to locate strategies for optional claims. */
+ @Nonnull private Function<ProfileRequestContext,Map<String, Function<ProfileRequestContext,Object>>>
+ optionalClaimsLookupStrategiesLookupStrategy;
/** Metadata to publish. */
@NonnullBeforeExec private Map<String,Map<String,Object>> metadata;
@@ -85,6 +83,7 @@ public class BuildEntityConfiguration extends AbstractBuildEntityStatementAction
signingConfigurationsLookupStrategy = new JWTSignatureSigningConfigurationLookupFunction();
entityConfigurationLifetimeLookupStrategy = new EntityStatementLifetimeLookupFunction();
authorityHintsLookupStrategy = new AuthorityHintsLookupFunction();
+ optionalClaimsLookupStrategiesLookupStrategy = new OptionalClaimsLookupStrategiesLookupFunction();
}
/**
@@ -125,29 +124,16 @@ public class BuildEntityConfiguration extends AbstractBuildEntityStatementAction
}
/**
- * Set the strategy used to locate trust anchor hints.
+ * Set the strategy used to locate strategies for optional claims.
*
* @param strategy lookup strategy
*/
- public void setTrustAnchorHintsLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,List<String>> strategy) {
+ public void setOptionalClaimsLookupStrategiesLookupStrategy(@Nonnull final
+ Function<ProfileRequestContext, Map<String,Function<ProfileRequestContext,Object>>> strategy) {
checkSetterPreconditions();
- trustAnchorHintsLookupStrategy =
- Constraint.isNotNull(strategy, "Trust anchor hints lookup strategy cannot be null");
- }
-
- /**
- * Set the map of lookup strategies to locate values for optional claims.
- *
- * @param strategies map of lookup strategies
- */
- public void setOptionalClaimsLookupStrategies(
- @Nonnull final Map<String,Function<ProfileRequestContext,Object>> strategies) {
- checkSetterPreconditions();
-
- optionalClaimsLookupStrategies =
- Constraint.isNotNull(strategies, "Optional claims lookup strategies cannot be null");
+ optionalClaimsLookupStrategiesLookupStrategy =
+ Constraint.isNotNull(strategy, "Optional claims lookup strategies lookup strategy cannot be null");
}
/** {@inheritDoc} */
@@ -155,11 +141,9 @@ public class BuildEntityConfiguration extends AbstractBuildEntityStatementAction
protected void doInitialize() throws ComponentInitializationException {
super.doInitialize();
- if (trustAnchorHintsLookupStrategy == null) {
- throw new ComponentInitializationException("Trust anchor hints lookup strategy cannot be null");
- }
- if (optionalClaimsLookupStrategies == null) {
- throw new ComponentInitializationException("Optional claims lookup strategies cannot be null");
+ if (optionalClaimsLookupStrategiesLookupStrategy == null) {
+ throw new ComponentInitializationException(
+ "Optional claims lookup strategies lookup strategy cannot be null");
}
}
@@ -220,19 +204,19 @@ public class BuildEntityConfiguration extends AbstractBuildEntityStatementAction
if (authorityHints != null && !authorityHints.isEmpty()) {
builder.claim("authority_hints", authorityHints);
}
- final List<String> trustAnchorHints = trustAnchorHintsLookupStrategy.apply(profileRequestContext);
- if (trustAnchorHints != null && !trustAnchorHints.isEmpty()) {
- builder.claim("trust_anchor_hints", trustAnchorHints);
- }
- for (final String claim : optionalClaimsLookupStrategies.keySet()) {
- log.trace("{} Looking up the value for clain {}", getLogPrefix(), claim);
- final Function<ProfileRequestContext,Object> lookup = optionalClaimsLookupStrategies.get(claim);
- final Object value = lookup.apply(profileRequestContext);
- if (value != null) {
- log.debug("{} Resolved value {} for clain {}", getLogPrefix(), value, claim);
- builder.claim(claim, value);
- } else {
- log.debug("{} No value resolved for clain {}", getLogPrefix(), claim);
+ final Map<String, Function<ProfileRequestContext, Object>> optionalClaimsLookupStrategies =
+ optionalClaimsLookupStrategiesLookupStrategy.apply(profileRequestContext);
+ if (optionalClaimsLookupStrategies != null) {
+ for (final String claim : optionalClaimsLookupStrategies.keySet()) {
+ log.trace("{} Looking up the value for clain {}", getLogPrefix(), claim);
+ final Function<ProfileRequestContext,Object> lookup = optionalClaimsLookupStrategies.get(claim);
+ final Object value = lookup.apply(profileRequestContext);
+ if (value != null) {
+ log.debug("{} Resolved value {} for clain {}", getLogPrefix(), value, claim);
+ builder.claim(claim, value);
+ } else {
+ log.debug("{} No value resolved for clain {}", getLogPrefix(), claim);
+ }
}
}
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 7230ea8..58cfd0b 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -713,6 +713,5 @@
p:trustMarkCache-ref="shibboleth.oidfed.TrustMarkMetadataCache"/>
<import resource="${idp.home}/conf/oidfed/oidfed-trustchain-resolver.xml"/>
- <import resource="${idp.home}/conf/oidfed/oidfed-entity-configuration-claims.xml"/>
</beans>
\ No newline at end of file
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/entity-configuration/entity-configuration-beans.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/entity-configuration/entity-configuration-beans.xml
index 053f4fe..169536c 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/entity-configuration/entity-configuration-beans.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/entity-configuration/entity-configuration-beans.xml
@@ -97,13 +97,7 @@
<bean id="BuildEntityStatement"
class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.BuildEntityConfiguration" scope="prototype"
p:identifierGeneratorLookupStrategy-ref="shibboleth.oidc.DefaultIdentifierGenerationStrategy"
- p:objectMapper-ref="#{'%{idp.oidc.logging.objectMapper:shibboleth.oidc.JSONObjectMapper}'.trim()}"
- p:trustAnchorHintsLookupStrategy-ref="#{'%{idp.oidfed.entity-configuration.trustAnchoHintsLookup:DefaultTrustAnchorHintsLookupStrategy}'.trim()}"
- p:optionalClaimsLookupStrategies-ref="shibboleth.oidfed.EntityConfigurationClaimLookupStrategies" />
-
- <bean id="DefaultTrustAnchorHintsLookupStrategy"
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate.DefaultTrustAnchorHintsLookupStrategy"
- p:trustAnchorsCache-ref="shibboleth.oidfed.LocalTrustAnchorsMetadataCache"/>
+ p:objectMapper-ref="#{'%{idp.oidc.logging.objectMapper:shibboleth.oidc.JSONObjectMapper}'.trim()}"/>
<bean id="SignEntityStatement" class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor"
scope="prototype" c:executionDirection="OUTBOUND ">
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index 93267a1..70a942e 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -15,7 +15,8 @@
<bean id="OIDFED.Configuration" parent="AbstractOIDFederationProfile" lazy-init="true"
class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.impl.DefaultOIDFederationEntityConfigurationProfileConfiguration"
p:issuer-ref="shibboleth.oidc.issuer"
- p:authorityHints="%{idp.oidfed.entity.authorityHints:https://example.org}" />
+ p:authorityHints="%{idp.oidfed.entity.authorityHints:https://example.org}"
+ p:optionalClaimsLookupStrategies-ref="shibboleth.oidfed.EntityConfigurationClaimsLookupStrategies" />
<bean id="OIDFED.AutomaticRegistration" parent="AbstractOIDFederationProfile" lazy-init="true"
class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.impl.DefaultOIDFederationAutomaticRegistrationProfileConfiguration"
@@ -95,5 +96,11 @@
<bean id="RelyingPartyByTrustAnchor" abstract="true" parent="RelyingParty"
class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.context.RelyingPartyConfigurationSupport" factory-method="byTrustAnchor" />
-
+
+ <bean id="DefaultTrustAnchorHintsLookupStrategy"
+ class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate.DefaultTrustAnchorHintsLookupStrategy"
+ p:trustAnchorsCache-ref="shibboleth.oidfed.LocalTrustAnchorsMetadataCache"/>
+
+ <import resource="${idp.home}/conf/oidfed/oidfed-entity-configuration-claims.xml"/>
+
</beans>
diff --git a/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/oidfed/oidfed-entity-configuration-claims.xml b/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/oidfed/oidfed-entity-configuration-claims.xml
index dac0420..67452e6 100644
--- a/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/oidfed/oidfed-entity-configuration-claims.xml
+++ b/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/oidfed/oidfed-entity-configuration-claims.xml
@@ -10,8 +10,9 @@
default-init-method="initialize" default-destroy-method="destroy">
<!-- TODO: document with examples once the structure is settled -->
- <util:map id="shibboleth.oidfed.EntityConfigurationClaimLookupStrategies"
+ <util:map id="shibboleth.oidfed.EntityConfigurationClaimsLookupStrategies"
value-type="java.util.function.Function">
+ <entry key="trust_anchor_hints" value-ref="#{'%{idp.oidfed.entity-configuration.trustAnchoHintsLookup:DefaultTrustAnchorHintsLookupStrategy}'.trim()}"/>
</util:map>
</beans>
\ No newline at end of file
diff --git a/idp-oidfed-op-impl/src/test/resources/net/shibboleth/idp/module/conf/oidfed/oidfed-entity-configuration-claims.xml b/idp-oidfed-op-impl/src/test/resources/net/shibboleth/idp/module/conf/oidfed/oidfed-entity-configuration-claims.xml
index 26504a9..0a6dea6 100644
--- a/idp-oidfed-op-impl/src/test/resources/net/shibboleth/idp/module/conf/oidfed/oidfed-entity-configuration-claims.xml
+++ b/idp-oidfed-op-impl/src/test/resources/net/shibboleth/idp/module/conf/oidfed/oidfed-entity-configuration-claims.xml
@@ -13,8 +13,9 @@
class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.TrustedRemoteEntity"
c:entity="https://dyn-trust-mark-issuer.federation.local"/>
- <util:map id="shibboleth.oidfed.EntityConfigurationClaimLookupStrategies"
+ <util:map id="shibboleth.oidfed.EntityConfigurationClaimsLookupStrategies"
value-type="java.util.function.Function">
+ <entry key="trust_anchor_hints" value-ref="#{'%{idp.oidfed.entity-configuration.trustAnchoHintsLookup:DefaultTrustAnchorHintsLookupStrategy}'.trim()}"/>
<entry key="trust_marks">
<bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate.DefaultEntityConfigurationTrustMarksLookupStrategy">
<property name="trustMarkLookupStrategies">
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list