[java-idp-plugin-vci] 02/03: Rename 'BuildResponse' to 'BuildResponseMessage'. Token endpoint to adopt more actual OP like access token handling for code flow.
Codeberg
noreply at shibboleth.net
Thu Dec 4 14:14:40 UTC 2025
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-idp-plugin-vci.
View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-vci/commit/cd074fcd20d67c5d29da4fe0645e021bc58b3cca
commit cd074fcd20d67c5d29da4fe0645e021bc58b3cca
Author: jlauros <janne.lauros at csc.fi>
AuthorDate: Thu Dec 4 16:09:13 2025 +0200
Rename 'BuildResponse' to 'BuildResponseMessage'. Token endpoint to adopt more actual OP like access token handling for code flow.
---
.../openid/vci/abstract-api/abstract-api-flow.xml | 2 +-
.../vci/credential-offer/credential-offer-flow.xml | 2 +-
.../openid/vci/credentials/credentials-flow.xml | 2 +-
.../idp/flows/openid/vci/nonce/nonce-flow.xml | 2 +-
.../idp/flows/openid/vci/token/token-beans.xml | 53 ++++++++++++++++++++++
.../idp/flows/openid/vci/token/token-flow.xml | 31 ++++++++++---
6 files changed, 81 insertions(+), 11 deletions(-)
diff --git a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/abstract-api/abstract-api-flow.xml b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/abstract-api/abstract-api-flow.xml
index 061dcb0..dc924ef 100644
--- a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/abstract-api/abstract-api-flow.xml
+++ b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/abstract-api/abstract-api-flow.xml
@@ -42,7 +42,7 @@
<transition on="RestartAuthentication" to="AuthenticationSetup" />
</subflow-state>
- <action-state id="BuildResponse">
+ <action-state id="BuildResponseMessage">
<evaluate expression="FormOutboundMessage"/>
<evaluate expression="'proceed'"/>
<transition on="proceed" to="CommitResponse"/>
diff --git a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/credential-offer/credential-offer-flow.xml b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/credential-offer/credential-offer-flow.xml
index 6df3f55..25b765e 100644
--- a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/credential-offer/credential-offer-flow.xml
+++ b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/credential-offer/credential-offer-flow.xml
@@ -19,7 +19,7 @@
<evaluate expression="ValidateCredentialOffering"/>
<evaluate expression="BuildCredentialOfferToken"/>
<evaluate expression="'proceed'"/>
- <transition on="proceed" to="BuildResponse"/>
+ <transition on="proceed" to="BuildResponseMessage"/>
</action-state>
<bean-import resource="credential-offer-beans.xml"/>
diff --git a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/credentials/credentials-flow.xml b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/credentials/credentials-flow.xml
index 2e1ac8b..c54171f 100644
--- a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/credentials/credentials-flow.xml
+++ b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/credentials/credentials-flow.xml
@@ -31,7 +31,7 @@
<action-state id="ResumeAfterAuthentication">
<evaluate expression="PopulateCredentialsSignatureSigningParameters" />
<evaluate expression="'proceed'"/>
- <transition on="proceed" to="BuildResponse"/>
+ <transition on="proceed" to="BuildResponseMessage"/>
</action-state>
<bean-import resource="credentials-beans.xml"/>
diff --git a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/nonce/nonce-flow.xml b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/nonce/nonce-flow.xml
index 69ebc74..bfe9ebd 100644
--- a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/nonce/nonce-flow.xml
+++ b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/nonce/nonce-flow.xml
@@ -13,7 +13,7 @@
<evaluate expression="SelectRelyingPartyConfiguration" />
<evaluate expression="SelectProfileConfiguration" />
<evaluate expression="'proceed'"/>
- <transition on="proceed" to="BuildResponse"/>
+ <transition on="proceed" to="BuildResponseMessage"/>
</action-state>
<bean-import resource="nonce-beans.xml"/>
diff --git a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/token/token-beans.xml b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/token/token-beans.xml
index 6ffc14d..f454abe 100644
--- a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/token/token-beans.xml
+++ b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/token/token-beans.xml
@@ -24,6 +24,16 @@
c:sealer-ref="#{'%{idp.oidc.tokenSealer:shibboleth.oidc.TokenSealer}'.trim()}"
p:clientIDLookupStrategy-ref="shibboleth.ClientIDLookupStrategy"
p:credentialOfferCache-ref="openidvci.CredentialOfferCache"/>
+
+ <bean id="ValidateGrant" class="org.geant.shibboleth.plugin.openidvci.profile.impl.ValidateGrant" scope="prototype"
+ p:replayCache-ref="shibboleth.ReplayCache"
+ p:revocationCache-ref="shibboleth.oidc.RevocationCache"
+ p:tokenRevocationCondition="#{getObject('%{idp.oauth2.revocationCondition:shibboleth.BiConditions.FALSE}')}">
+ <property name="chainRevocationLifetimeLookupStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.profile.logic.DefaultChainRevocationLifetimeLookupStrategy"
+ p:clockSkew="%{idp.policy.clockSkew:PT5M}" p:useActiveProfileOnly="false" />
+ </property>
+ </bean>
<bean id="ValidateExpectedGrantType" class="org.geant.shibboleth.plugin.openidvci.profile.impl.ValidateExpectedGrantType"
scope="prototype"/>
@@ -41,6 +51,49 @@
<bean id="InitializeAuthenticationContext" class="org.geant.shibboleth.plugin.openidvci.profile.impl.InitializeAuthenticationContext"
scope="prototype" />
+
+ <bean id="SetRequestedClaimsToResponseContext"
+ class="net.shibboleth.idp.plugin.oidc.op.profile.impl.SetRequestedClaimsToResponseContext" scope="prototype"
+ p:requestedClaimsLookupStrategy-ref="shibboleth.TokenRequestRequestedClaimsLookupFunction"
+ p:transcoderRegistry-ref="shibboleth.AttributeRegistryService" />
+
+ <bean id="shibboleth.TokenRequestRequestedClaimsLookupFunction"
+ class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestRequestedClaimsLookupFunction" />
+
+ <bean id="SetAuthenticationContextClassReferenceFromAuthzCodeToResponseContext"
+ class="net.shibboleth.idp.plugin.oidc.op.profile.impl.SetAuthenticationContextClassReferenceFromAuthzCodeToResponseContext"
+ scope="prototype" />
+
+ <bean id="SetAuthenticationTimeFromAuthzCodeToResponseContext"
+ class="net.shibboleth.idp.plugin.oidc.op.profile.impl.SetAuthenticationTimeToResponseContext" scope="prototype"
+ p:authTimeLookupStrategy-ref="shibboleth.TokenRequestAuthTimeLookupFunction" />
+
+ <bean id="shibboleth.TokenRequestAuthTimeLookupFunction"
+ class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestAuthTimeLookupFunction" />
+
+ <bean id="SetTokenDeliveryAttributesFromTokenToResponseContext"
+ class="net.shibboleth.idp.plugin.oidc.op.profile.impl.SetTokenDeliveryAttributesFromTokenToResponseContext"
+ scope="prototype" />
+
+ <bean id="SetConsentToResponseContext"
+ class="net.shibboleth.idp.plugin.oidc.op.profile.impl.SetConsentFromTokenToResponseContext" scope="prototype" />
+
+ <bean id="InitializeSubjectContext"
+ class="net.shibboleth.idp.plugin.oidc.op.profile.impl.InitializeSubjectContext" scope="prototype" />
+
+ <bean id="SetSubjectFromAuthzCodeToResponseContext"
+ class="net.shibboleth.idp.plugin.oidc.op.profile.impl.SetSubjectToResponseContext" scope="prototype" />
+
+ <bean id="BuildAccessToken"
+ class="net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.BuildAccessToken" scope="prototype"
+ p:dataSealer="#{getObject('%{idp.oidc.tokenSealer:shibboleth.oidc.TokenSealer}'.trim())}"
+ p:xmlSafeIdentifier="%{idp.oidc.xmlSafeIdentifiers:true}"
+ p:identifierGeneratorLookupStrategy-ref="shibboleth.oidc.DefaultIdentifierGenerationStrategy"
+ p:objectMapper-ref="#{'%{idp.oidc.logging.objectMapper:shibboleth.oidc.JSONObjectMapper}'.trim()}" />
+
+ <bean id="SetOAuthAccessTokenToResponseContext"
+ class="net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.SetAccessTokenToResponseContext"
+ scope="prototype" />
<bean id="FormOutboundMessage" class="org.geant.shibboleth.plugin.openidvci.profile.impl.FormOutboundTokenResponseMessage"
scope="prototype" p:issuerLookupStrategy-ref="shibboleth.ResponderIdLookup.Simple"
diff --git a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/token/token-flow.xml b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/token/token-flow.xml
index a008b4c..f665deb 100644
--- a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/token/token-flow.xml
+++ b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/token/token-flow.xml
@@ -30,22 +30,32 @@
<action-state id="ResumeAfterAuthentication">
<evaluate expression="'proceed'" />
- <transition on="proceed" to="CheckRequestType">
+ <transition on="proceed" to="BranchOnGrantType">
<set name="flowScope.codeFlow" value="codeFlow.test(opensamlProfileRequestContext)" />
</transition>
</action-state>
- <decision-state id="CheckRequestType">
- <if test="codeFlow" then="ValidateCodeFlow" else="ValidatePreAuthFlow" />
+ <decision-state id="BranchOnGrantType">
+ <if test="codeFlow" then="TraditionalGrantProcessing" else="PreAuthzGrantProcessing" />
</decision-state>
- <action-state id="ValidateCodeFlow">
+ <action-state id="TraditionalGrantProcessing">
<evaluate expression="ValidateExpectedGrantType"/>
+ <evaluate expression="ValidateGrant"/>
+ <evaluate expression="SetRequestedClaimsToResponseContext" />
+ <evaluate expression="SetRequestedClaimsToResponseContext" />
+ <evaluate expression="SetAuthenticationContextClassReferenceFromAuthzCodeToResponseContext" />
+ <evaluate expression="SetAuthenticationTimeFromAuthzCodeToResponseContext" />
+ <evaluate expression="SetTokenDeliveryAttributesFromTokenToResponseContext" />
+ <evaluate expression="SetConsentToResponseContext" />
+ <evaluate expression="InitializeSubjectContext" />
+ <evaluate expression="SetSubjectFromAuthzCodeToResponseContext" />
+
<evaluate expression="'proceed'"/>
<transition on="proceed" to="PostValidation"/>
</action-state>
- <action-state id="ValidatePreAuthFlow">
+ <action-state id="PreAuthzGrantProcessing">
<evaluate expression="ValidateExpectedGrantType"/>
<evaluate expression="ValidateTxCode"/>
<evaluate expression="'proceed'"/>
@@ -55,9 +65,16 @@
<action-state id="PostValidation">
<evaluate expression="SetAuthorizationDetailsToResponseContext"/>
<evaluate expression="'proceed'"/>
- <transition on="proceed" to="BuildResponse"/>
+ <transition on="proceed" to="BuildTokensForCredentialsAccess"/>
</action-state>
-
+
+ <action-state id="BuildTokensForCredentialsAccess">
+ <evaluate expression="BuildAccessToken" />
+ <evaluate expression="SetOAuthAccessTokenToResponseContext" />
+ <evaluate expression="'proceed'" />
+ <transition on="proceed" to="BuildResponseMessage" />
+ </action-state>
+
<bean-import resource="token-beans.xml"/>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list