[java-idp-plugin-oidc-op-oidfed] branch main updated: Harmonised the expiration time strategy for response containers
Codeberg
noreply at shibboleth.net
Fri Dec 5 13:51:52 UTC 2025
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-idp-plugin-oidc-op-oidfed.
View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-oidc-op-oidfed/commit/3a4b19212aa51ccccdd988c24b461de95a798ebc
The following commit(s) were added to refs/heads/main by this push:
new 3a4b192 Harmonised the expiration time strategy for response containers
3a4b192 is described below
commit 3a4b19212aa51ccccdd988c24b461de95a798ebc
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Dec 5 15:51:20 2025 +0200
Harmonised the expiration time strategy for response containers
---
...usResponseContainerExpirationTimeStrategy.java} | 4 +-
...ityResponseContainerExpirationTimeStrategy.java | 59 ----------------------
...arkResponseContainerExpirationTimeStrategy.java | 59 ----------------------
.../META-INF/net.shibboleth.idp/postconfig.xml | 4 +-
.../entity-configuration-beans.xml | 2 +-
.../oidfed/resolve-entity/resolve-entity-beans.xml | 2 +-
6 files changed, 6 insertions(+), 124 deletions(-)
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultEntityConfigurationResponseContainerExpirationTimeStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultNimbusResponseContainerExpirationTimeStrategy.java
similarity index 92%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultEntityConfigurationResponseContainerExpirationTimeStrategy.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultNimbusResponseContainerExpirationTimeStrategy.java
index 56275fd..700a849 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultEntityConfigurationResponseContainerExpirationTimeStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultNimbusResponseContainerExpirationTimeStrategy.java
@@ -29,12 +29,12 @@ import com.nimbusds.openid.connect.sdk.federation.config.FederationEntityConfigu
import net.shibboleth.oidc.metadata.cache.ExpirationTimeContext;
/**
- * Default strategy for fetching expiration time for the entity configuration response container. The expiration instant
+ * Default strategy for fetching expiration time for the Nimbus response container. The expiration instant
* is fetched from which is before: the success response message's JWT expiration time or the instant returned by
* {@link NimbusResponseContainer#getExpirationInstant()} or {@link ExpirationTimeContext#getMaxCacheDuration()}.
*/
@ThreadSafe
-public class DefaultEntityConfigurationResponseContainerExpirationTimeStrategy
+public class DefaultNimbusResponseContainerExpirationTimeStrategy
implements Function<ExpirationTimeContext<NimbusResponseContainer>, Instant> {
/** {@inheritDoc} */
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultResolveEntityResponseContainerExpirationTimeStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultResolveEntityResponseContainerExpirationTimeStrategy.java
deleted file mode 100644
index 4730da4..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultResolveEntityResponseContainerExpirationTimeStrategy.java
+++ /dev/null
@@ -1,59 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
-
-import java.text.ParseException;
-import java.time.Instant;
-import java.util.function.Function;
-
-import javax.annotation.Nullable;
-import javax.annotation.concurrent.ThreadSafe;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl.ResolveEntityResponse;
-import net.shibboleth.oidc.metadata.cache.ExpirationTimeContext;
-
-/**
- * Default strategy for fetching expiration time for the resolve entity response container. The expiration instant is
- * fetched from which is before: the success response message's JWT expiration time or the instant returned by
- * {@link ResolveEntityResponseContainer#getExpirationInstant()}.
- */
- at ThreadSafe
-public class DefaultResolveEntityResponseContainerExpirationTimeStrategy
- implements Function<ExpirationTimeContext<ResolveEntityResponseContainer>, Instant> {
-
- /** {@inheritDoc} */
- @Nullable public Instant apply(@Nullable final ExpirationTimeContext<ResolveEntityResponseContainer> context) {
- if (context == null) {
- return null;
- }
- final Instant contextExpiration = context.getNow().plus(context.getMaxCacheDuration());
- final ResolveEntityResponseContainer container = context.getMetadata();
- if (container == null || container.getExpirationInstant() == null) {
- return contextExpiration;
- }
- final Instant containerExpiration = container.getExpirationInstant();
- if (container.getResponse() instanceof ResolveEntityResponse successResponse) {
- try {
- final Instant jwtExpiration =
- successResponse.getJWT().getJWTClaimsSet().getExpirationTime().toInstant();
- return jwtExpiration.isBefore(containerExpiration) ? jwtExpiration : containerExpiration;
- } catch (final ParseException e) {
- // ignore, use container expiration
- }
- }
- return containerExpiration;
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultTrustMarkResponseContainerExpirationTimeStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultTrustMarkResponseContainerExpirationTimeStrategy.java
deleted file mode 100644
index a76484c..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultTrustMarkResponseContainerExpirationTimeStrategy.java
+++ /dev/null
@@ -1,59 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
-
-import java.text.ParseException;
-import java.time.Instant;
-import java.util.function.Function;
-
-import javax.annotation.Nullable;
-import javax.annotation.concurrent.ThreadSafe;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl.TrustMarkResponse;
-import net.shibboleth.oidc.metadata.cache.ExpirationTimeContext;
-
-/**
- * Default strategy for fetching expiration time for the trust mark response container. The expiration instant is
- * fetched from which is before: the success response message's JWT expiration time or the instant returned by
- * {@link TrustMarkResponseContainer#getExpirationInstant()}.
- */
- at ThreadSafe
-public class DefaultTrustMarkResponseContainerExpirationTimeStrategy
- implements Function<ExpirationTimeContext<TrustMarkResponseContainer>, Instant> {
-
- /** {@inheritDoc} */
- @Nullable public Instant apply(@Nullable final ExpirationTimeContext<TrustMarkResponseContainer> context) {
- if (context == null) {
- return null;
- }
- final Instant contextExpiration = context.getNow().plus(context.getMaxCacheDuration());
- final TrustMarkResponseContainer container = context.getMetadata();
- if (container == null || container.getExpirationInstant() == null) {
- return contextExpiration;
- }
- final Instant containerExpiration = container.getExpirationInstant();
- if (container.getResponse() instanceof TrustMarkResponse successResponse) {
- try {
- final Instant jwtExpiration =
- successResponse.getJWT().getJWTClaimsSet().getExpirationTime().toInstant();
- return jwtExpiration.isBefore(containerExpiration) ? jwtExpiration : containerExpiration;
- } catch (final ParseException e) {
- // ignore, use container expiration
- }
- }
- return containerExpiration;
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 30255cd..5fde339 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -272,7 +272,7 @@
<bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.DefaultResolveEntityResponseIdentifierExtractionStrategy" />
</property>
<property name="metadataExpirationTimeStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.DefaultResolveEntityResponseContainerExpirationTimeStrategy"/>
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.DefaultNimbusResponseContainerExpirationTimeStrategy"/>
</property>
<property name="metadataFilterStrategy">
<bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.DefaultResolveEntityResponseSignatureValidationFilterStrategy"
@@ -395,7 +395,7 @@
p:objectMapper-ref="shibboleth.oidfed.policy.JSONObjectMapper"/>
</property>
<property name="metadataExpirationTimeStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.DefaultTrustMarkResponseContainerExpirationTimeStrategy"/>
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.DefaultNimbusResponseContainerExpirationTimeStrategy"/>
</property>
</bean>
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/entity-configuration/entity-configuration-beans.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/entity-configuration/entity-configuration-beans.xml
index 169536c..6cd7e13 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/entity-configuration/entity-configuration-beans.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/entity-configuration/entity-configuration-beans.xml
@@ -33,7 +33,7 @@
<bean parent="shibboleth.Functions.Constant" c:target-ref="shibboleth.oidc.issuer" />
</property>
<property name="metadataExpirationTimeStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.DefaultEntityConfigurationResponseContainerExpirationTimeStrategy"/>
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.DefaultNimbusResponseContainerExpirationTimeStrategy"/>
</property>
<property name="metadataFilterStrategy">
<bean parent="shibboleth.BiFunctions.Expression" c:expression="#input1"/>
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/resolve-entity/resolve-entity-beans.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/resolve-entity/resolve-entity-beans.xml
index b0ddbbd..8e6859a 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/resolve-entity/resolve-entity-beans.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/resolve-entity/resolve-entity-beans.xml
@@ -54,7 +54,7 @@
<bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.DefaultResolveEntityResponseIdentifierExtractionStrategy" />
</property>
<property name="metadataExpirationTimeStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.DefaultResolveEntityResponseContainerExpirationTimeStrategy"/>
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.DefaultNimbusResponseContainerExpirationTimeStrategy"/>
</property>
<property name="metadataFilterStrategy">
<bean parent="shibboleth.BiFunctions.Expression" c:expression="#input1"/>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list