[java-idp-plugin-oidc-op-oidfed] branch dev/CACHE-REFACTOR updated: Refactoring the metadata cache packaging on the impl-module
Codeberg
noreply at shibboleth.net
Thu Dec 18 06:38:27 UTC 2025
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch dev/CACHE-REFACTOR
in repository java-idp-plugin-oidc-op-oidfed.
View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-oidc-op-oidfed/commit/a661b763c8f8f9c5da33a67124b46530f209c96d
The following commit(s) were added to refs/heads/dev/CACHE-REFACTOR by this push:
new a661b76 Refactoring the metadata cache packaging on the impl-module
a661b76 is described below
commit a661b763c8f8f9c5da33a67124b46530f209c96d
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Thu Dec 18 08:38:00 2025 +0200
Refactoring the metadata cache packaging on the impl-module
- Also removed obsolete ObjectMapper-wirings (we know deserialize all claims earlier in the flow)
---
.../ExplicitClientRegistrationRequestDecoder.java | 2 +-
...faultEntityStatementExpirationTimeStrategy.java | 46 -----
.../op/oidfed/metadata/EntityStatementHelper.java | 192 ---------------------
...mbinedMetadataFromTrustChainLookupStrategy.java | 32 +---
...IssuerEntityIDCriteriaToIdentifierStrategy.java | 2 +-
...rustChainSignatureValidationFilterStrategy.java | 4 +-
...efaultProvidedTrustChainValidationStrategy.java | 3 +-
...ubjectEntityIDCriteriaToIdentifierStrategy.java | 2 +-
...DefaultTrustChainTrustMarksParsingStrategy.java | 37 +---
...ChainTrustedTrustMarkIssuersLookupStrategy.java | 33 +---
...tChainTrustedTrustMarkOwnersLookupStrategy.java | 4 +-
.../{ => cache}/IssuerEntityIDCriterion.java | 2 +-
.../PreSelectedTrustChainCriterion.java | 2 +-
.../ResponseContainerExpirationCriterion.java | 2 +-
...ignatureValidationKeyContainerJwtCriterion.java | 2 +-
.../{ => cache}/SubjectEntityIDCriterion.java | 2 +-
.../SubjectLocallyTrustedKeysCriterion.java | 2 +-
.../{ => cache}/TrustAnchorEntityIDsCriterion.java | 2 +-
.../metadata/{ => cache}/TrustMarkCriterion.java | 2 +-
.../{ => cache}/TrustMarkOwnersCriterion.java | 2 +-
...onfigurationMetadataSkeletonLookupStrategy.java | 2 +-
...ntityConfigurationResponseFetchingStrategy.java | 3 +-
...StatementSignatureValidationFilterStrategy.java | 6 +-
.../local}/DefaultLocalTrustAnchorsValidator.java | 2 +-
...busResponseContainerExpirationTimeStrategy.java | 2 +-
...eEntityRequestCriteriaToIdentifierStrategy.java | 2 +-
...faultResolveEntityResponseFetchingStrategy.java | 3 +-
...EntityResponseIdentifierExtractionStrategy.java | 2 +-
.../{ => cache/local}/LocalKeyContainer.java | 2 +-
.../{ => cache/local}/NimbusResponseContainer.java | 2 +-
.../{ => cache/local}/NimbusResponseCriterion.java | 2 +-
.../local}/ResolveEntityRequestCriterion.java | 2 +-
.../local}/ResolveEntityResponseContainer.java | 2 +-
...FederationEndpointResponseFetchingStrategy.java | 2 +-
...actTrustEngineSignatureValidationComponent.java | 2 +-
.../BaseExpirableEntityStatementContainer.java | 2 +-
.../BaseExpirableMetadataContainer.java | 2 +-
...tEntityStatementContentValidationCondition.java | 2 +-
...faultEntityStatementMetadataFilterStrategy.java | 2 +-
...ntityStatementSignatureValidationCondition.java | 4 +-
...atementValidationCriteriaSetLookupFunction.java | 4 +-
...ultResponseContainerExpirationTimeStrategy.java | 2 +-
.../IssuerEntityStatementCriterion.java | 2 +-
.../RemoteEntityConfigurationContainer.java | 2 +-
.../RemoteSubordinateStatementContainer.java | 2 +-
.../{ => remote}/RemoteTrustChainsContainer.java | 2 +-
.../SubjectEntityStatementCriterion.java | 2 +-
.../SubordinateStatementCacheIdentifier.java | 2 +-
...tityConfigurationCriteriaSetLookupFunction.java | 6 +-
...DefaultEntityConfigurationFetchingStrategy.java | 8 +-
...ultResolveEntityTrustChainFetchingStrategy.java | 4 +-
...emoteResolveEntityCacheContainerIdentifier.java | 2 +-
...emoteResolveEntityCacheIdentifierCriterion.java | 2 +-
.../RemoteResolveEntityResponseContainer.java | 4 +-
...inateStatementCriteriaToIdentifierStrategy.java | 4 +-
...efaultSubordinateStatementFetchingStrategy.java | 14 +-
...rustChainSignatureValidationFilterStrategy.java | 8 +-
.../DefaultTrustChainFetchingStrategy.java | 20 +--
...stChainSubjectIdentifierExtractionStrategy.java | 4 +-
.../DefaultTrustMarkFetchingStrategy.java | 4 +-
.../DefaultTrustMarkStatusFetchingStrategy.java | 4 +-
...ustMarkValidationCriteriaSetLookupFunction.java | 12 +-
.../trustmark}/RemoteTrustMarkContainer.java | 4 +-
.../trustmark}/RemoteTrustMarkStatusContainer.java | 4 +-
.../trustmark}/TrustMarkCacheIdentifier.java | 2 +-
.../trustmark}/TrustMarkIdentifierCriterion.java | 2 +-
.../trustmark}/TrustMarkStatusCacheIdentifier.java | 2 +-
.../TrustMarkStatusIdentifierCriterion.java | 2 +-
.../jackson/LocalKeyContainerDeserializer.java | 2 +-
.../metadata/util/EntityStatementHelper.java | 96 +++++++++++
.../BuildResolveEntityErrorResponseFromEvent.java | 8 +-
.../oidfed/profile/impl/CallResolveEntityApi.java | 14 +-
...TrustMarkFromMetadataCacheFetchingFunction.java | 12 +-
...ormOutboundFederationConfigurationResponse.java | 6 +-
.../impl/FormOutboundResolveEntityResponse.java | 8 +-
.../LookupCachedEntityConfigurationResponse.java | 2 +-
.../impl/LookupCachedResolveEntityResponse.java | 4 +-
.../op/oidfed/profile/impl/ResolveTrustChains.java | 6 +-
.../op/oidfed/profile/impl/ResolveTrustMarks.java | 8 +-
.../profile/impl/ValidateResolveEntityRequest.java | 4 +-
.../profile/impl/ValidateSelectedTrustChain.java | 4 +-
.../DefaultTrustAnchorHintsLookupStrategy.java | 2 +-
...ultTrustChainMetadataPolicyMergingStrategy.java | 29 +---
...faultEntityConfigurationCredentialResolver.java | 2 +-
.../DefaultLocalTrustAnchorCredentialResolver.java | 4 +-
...yloadSignatureValidationCredentialResolver.java | 2 +-
...aultSubordinateStatementCredentialResolver.java | 4 +-
.../DefaultTrustMarkOwnerCredentialResolver.java | 4 +-
.../META-INF/net.shibboleth.idp/postconfig.xml | 81 +++++----
.../oidfed/metadata-lookup-ext-oidfed-beans.xml | 14 +-
.../entity-configuration-beans.xml | 6 +-
.../idp/flows/oidfed/register/register-beans.xml | 24 ++-
.../oidfed/resolve-entity/resolve-entity-beans.xml | 22 +--
.../flow/oidfed/EntityConfigurationFlowTest.java | 2 +-
.../EntityConfigurationMetadataCacheTest.java | 6 +-
.../SubordinateStatementMetadataCacheTest.java | 8 +-
.../oidfed/cache/TrustChainMetadataCacheTest.java | 8 +-
pom.xml | 2 +-
98 files changed, 351 insertions(+), 596 deletions(-)
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/decoding/impl/ExplicitClientRegistrationRequestDecoder.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/decoding/impl/ExplicitClientRegistrationRequestDecoder.java
index a6ede2d..c304b0e 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/decoding/impl/ExplicitClientRegistrationRequestDecoder.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/decoding/impl/ExplicitClientRegistrationRequestDecoder.java
@@ -40,8 +40,8 @@ import net.shibboleth.idp.plugin.oidc.op.oauth2.decoding.impl.BaseOAuth2RequestD
import net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl.ExplicitClientRegistrationRequest;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityConfiguration;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatementHelper;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SubordinateStatement;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.util.EntityStatementHelper;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultEntityStatementExpirationTimeStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultEntityStatementExpirationTimeStrategy.java
deleted file mode 100644
index 6c20b3e..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultEntityStatementExpirationTimeStrategy.java
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
-
-import java.time.Instant;
-import java.util.function.Function;
-
-import javax.annotation.Nullable;
-import javax.annotation.concurrent.ThreadSafe;
-
-import net.shibboleth.oidc.metadata.cache.ExpirationTimeContext;
-
-/**
- * Default strategy for fetching expiration time for the entity statement.
- */
- at ThreadSafe
-public class DefaultEntityStatementExpirationTimeStrategy
- implements Function<ExpirationTimeContext<EntityStatement>, Instant> {
-
- /** {@inheritDoc} */
- @Nullable public Instant apply(@Nullable final ExpirationTimeContext<EntityStatement> context) {
- if (context == null) {
- return null;
- }
- final Instant contextExpiration = context.getNow().plus(context.getMaxCacheDuration());
- final EntityStatement statement = context.getMetadata();
- if (statement == null) {
- return contextExpiration;
- }
- final Instant metadataExpiration = statement.getParsedPayload().getExpiration();
- return metadataExpiration.isBefore(contextExpiration) ? metadataExpiration : contextExpiration;
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/EntityStatementHelper.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/EntityStatementHelper.java
deleted file mode 100644
index 7caa686..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/EntityStatementHelper.java
+++ /dev/null
@@ -1,192 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
-
-import java.net.URI;
-import java.util.List;
-import java.util.Map;
-import java.util.Optional;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.slf4j.Logger;
-
-import com.fasterxml.jackson.core.JsonProcessingException;
-import com.fasterxml.jackson.databind.JavaType;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.fasterxml.jackson.databind.type.MapType;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.RemoteEntityConfigurationContainer;
-import net.shibboleth.oidc.metadata.cache.MetadataCache;
-import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
-import net.shibboleth.shared.collection.CollectionSupport;
-import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.resolver.CriteriaSet;
-
-/**
- * Static utility method related to entity statements.
- */
-public class EntityStatementHelper {
-
- /** Class logger. */
- @Nonnull private final static Logger log = LoggerFactory.getLogger(EntityStatementHelper.class);
-
- /**
- * Parses the given claim as Map of Objects from the given entity statement.
- *
- * @param objectMapper object mapper used for parsing
- * @param entityStatement entity statement from which to parse the claim from
- * @param claim claim name to be parsed
- * @return claim value as map or empty map if it didn't exist or could be parsed
- */
- @Nonnull public static Map<String, Object> parseClaimAsMap(@Nonnull final ObjectMapper objectMapper,
- @Nonnull final EntityStatement entityStatement, @Nonnull final String claim ) {
- final Object rawClaim;
- try {
- rawClaim = entityStatement.getJwt().getJWTClaimsSet().getClaim(claim);
- } catch (final java.text.ParseException e) {
- log.warn("Could not parse claim {}", claim, e);
- return CollectionSupport.emptyMap();
- }
- log.trace("Raw {} claim value: {}", claim, rawClaim);
- if (rawClaim != null) {
- final JavaType objectType = objectMapper.constructType(Object.class);
- final JavaType stringType = objectMapper.constructType(String.class);
- final MapType objectMapType =
- objectMapper.getTypeFactory().constructMapType(Map.class, stringType, objectType);
- try {
- final Map<String, Object> result =
- objectMapper.readValue(rawClaim.toString(), objectMapType);
- if (result != null) {
- log.trace("Parsed {} map: {}", claim, result);
- return result;
- }
- } catch (final JsonProcessingException e) {
- log.warn("Could not parse " + claim + " from entity statement", e);
- }
- }
- log.trace("Returning empty map");
- return CollectionSupport.emptyMap();
- }
-
- /**
- * Parses the given claim as Map of Map of Objects from the given entity statement.
- *
- * @param objectMapper object mapper used for parsing
- * @param entityStatement entity statement from which to parse the claim from
- * @param claim claim name to be parsed
- * @return claim value as map or empty map if it didn't exist or could be parsed
- */
- @Nonnull public static Map<String, Map<String, Object>> parseClaimAsMapOfMaps(
- @Nonnull final ObjectMapper objectMapper, @Nonnull final EntityStatement entityStatement,
- @Nonnull final String claim ) {
- final Object rawClaim;
- try {
- rawClaim = entityStatement.getJwt().getJWTClaimsSet().getClaim(claim);
- } catch (final java.text.ParseException e) {
- log.warn("Could not parse claim {}", claim, e);
- return CollectionSupport.emptyMap();
- }
- log.trace("Raw {} claim value: {}", claim, rawClaim);
- if (rawClaim != null) {
- final JavaType objectType = objectMapper.constructType(Object.class);
- final JavaType stringType = objectMapper.constructType(String.class);
- final MapType objectMapType =
- objectMapper.getTypeFactory().constructMapType(Map.class, stringType, objectType);
- final MapType mapOfObjectMapType =
- objectMapper.getTypeFactory().constructMapType(Map.class, stringType, objectMapType);
- try {
- final Map<String, Map<String, Object>> result =
- objectMapper.readValue(rawClaim.toString(), mapOfObjectMapType);
- if (result != null) {
- log.trace("Parsed {} map: {}", claim, result);
- return result;
- }
- } catch (final JsonProcessingException e) {
- log.warn("Could not parse " + claim + " from entity statement", e);
- }
- }
- log.trace("Returning empty map");
- return CollectionSupport.emptyMap();
- }
-
- /**
- * Parses the "metadata" -claim from the given entity statement.
- *
- * @param objectMapper object mapper used for parsing
- * @param entityStatement entity statement from which to parse the claim from
- * @return the map of metadata or empty map if they didn't exist or could be parsed
- */
- @Nonnull public static Map<String, Map<String, Object>> parseMetadata(@Nonnull final ObjectMapper objectMapper,
- @Nonnull final EntityStatement entityStatement) {
- return parseClaimAsMapOfMaps(objectMapper, entityStatement, "metadata");
- }
-
- /**
- * Serialize the given trust chain into a comma-separated list of strings.
- *
- * @param trustChain input trust chain
- * @return serialized trust chain
- */
- @Nullable
- public static String getSerializedTrustChain(@Nullable final List<EntityStatement> trustChain) {
- return trustChain == null ? null :
- String.join(",", trustChain.stream().map(es -> es.getJwt().serialize()).toList());
- }
-
- /**
- * Serialize the given entity statement into a string.
- *
- * @param entityStatement input entity statement
- * @return serialized entity statement
- */
- @Nullable
- public static String getSerializedEntityStatement(@Nullable final EntityStatement entityStatement) {
- return entityStatement == null ? null : entityStatement.getJwt().serialize();
- }
-
- /**
- * Fetch the endpoint URI for the given endpoint ID from a federation_entity metadata. The entity statement is
- * fetched from the given cache by using the given entity ID as {@link SubjectEntityIDCriterion}.
- *
- * @param cache metadata cache used for fetching the entity configuration
- * @param entityId entity ID of the entity
- * @param endpointId the endpoint ID
- * @return endpoint URI
- */
- @Nullable public static URI fetchEndpointUriFromFederationEntity(
- @Nonnull MetadataCache<RemoteEntityConfigurationContainer> cache,
- @Nonnull final String entityId, @Nonnull final String endpointId) {
- final CriteriaSet criteria = new CriteriaSet(new SubjectEntityIDCriterion(entityId));
- try {
- final List<RemoteEntityConfigurationContainer> result = cache.get(criteria);
- if (!result.isEmpty()) {
- return Optional.ofNullable(result.get(0).getEntityStatement())
- .map(statement -> statement.getParsedPayload().getMetadata())
- .map(metadata -> metadata.get("federation_entity"))
- .map(map -> map.get(endpointId))
- .filter(String.class::isInstance)
- .map(String.class::cast)
- .map(URI::create)
- .orElse(null);
- }
- } catch (final MetadataCacheException e) {
- log.debug("Error while fetching entity configuration for {}", entityId, e);
- }
- log.warn("Could not fetch entity configuration for {}", entityId);
- return null;
- }
-}
\ No newline at end of file
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultCombinedMetadataFromTrustChainLookupStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultCombinedMetadataFromTrustChainLookupStrategy.java
similarity index 77%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultCombinedMetadataFromTrustChainLookupStrategy.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultCombinedMetadataFromTrustChainLookupStrategy.java
index ddf4e49..bff193a 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultCombinedMetadataFromTrustChainLookupStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultCombinedMetadataFromTrustChainLookupStrategy.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
import java.util.HashMap;
import java.util.List;
@@ -25,47 +25,23 @@ import javax.annotation.Nullable;
import org.slf4j.Logger;
-import com.fasterxml.jackson.databind.ObjectMapper;
-
-import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
+import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
-import net.shibboleth.shared.component.ComponentInitializationException;
-import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Default strategy to combine metadata claim contents from the trust chain by exploiting both entity configuration
* and subordinate statement issued by the immediate superior.
*/
+ at ThreadSafeAfterInit
public class DefaultCombinedMetadataFromTrustChainLookupStrategy extends AbstractIdentifiableInitializableComponent
implements Function<List<EntityStatement>,Map<String,Map<String,Object>>> {
/** Class logger. */
@Nonnull private Logger log = LoggerFactory.getLogger(DefaultCombinedMetadataFromTrustChainLookupStrategy.class);
- /** Object mapper used for deserializing metadata. */
- @NonnullAfterInit private ObjectMapper objectMapper;
-
- /**
- * Set the object mapper used for deserializing metadata
- *
- * @param mapper What to set.
- */
- public void setObjectMapper(@Nonnull final ObjectMapper mapper) {
- checkSetterPreconditions();
- objectMapper = Constraint.isNotNull(mapper, "Object mapper cannot be null");
- }
-
- /** {@inheritDoc} */
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
-
- if (objectMapper == null) {
- throw new ComponentInitializationException("Object mapper cannot be null");
- }
- }
-
/** {@inheritDoc} */
@Override @Nullable
public Map<String,Map<String,Object>> apply(@Nullable final List<EntityStatement> chain) {
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultIssuerEntityIDCriteriaToIdentifierStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultIssuerEntityIDCriteriaToIdentifierStrategy.java
similarity index 95%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultIssuerEntityIDCriteriaToIdentifierStrategy.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultIssuerEntityIDCriteriaToIdentifierStrategy.java
index 51b131f..a6198ce 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultIssuerEntityIDCriteriaToIdentifierStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultIssuerEntityIDCriteriaToIdentifierStrategy.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
import java.util.function.Function;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/tc/DefaultProvidedTrustChainSignatureValidationFilterStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultProvidedTrustChainSignatureValidationFilterStrategy.java
similarity index 95%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/tc/DefaultProvidedTrustChainSignatureValidationFilterStrategy.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultProvidedTrustChainSignatureValidationFilterStrategy.java
index 0066b6d..a805265 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/tc/DefaultProvidedTrustChainSignatureValidationFilterStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultProvidedTrustChainSignatureValidationFilterStrategy.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.tc;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
import java.util.ArrayList;
import java.util.List;
@@ -26,9 +26,7 @@ import org.slf4j.Logger;
import com.nimbusds.jwt.SignedJWT;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.AbstractTrustEngineSignatureValidationComponent;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SignatureValidationKeyContainerJwtCriterion;
import net.shibboleth.oidc.metadata.filter.MetadataFilterContext;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultProvidedTrustChainValidationStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultProvidedTrustChainValidationStrategy.java
similarity index 97%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultProvidedTrustChainValidationStrategy.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultProvidedTrustChainValidationStrategy.java
index e917c57..14af8dc 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultProvidedTrustChainValidationStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultProvidedTrustChainValidationStrategy.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
import java.util.List;
import java.util.Map;
@@ -27,6 +27,7 @@ import org.slf4j.Logger;
import com.fasterxml.jackson.databind.ObjectMapper;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.constraints.FederationPolicyConstraint;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.constraints.FederationPolicyConstraintHelper;
import net.shibboleth.oidc.metadata.filter.MetadataFilterContext;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultSubjectEntityIDCriteriaToIdentifierStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultSubjectEntityIDCriteriaToIdentifierStrategy.java
similarity index 95%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultSubjectEntityIDCriteriaToIdentifierStrategy.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultSubjectEntityIDCriteriaToIdentifierStrategy.java
index cdc5247..26fea82 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultSubjectEntityIDCriteriaToIdentifierStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultSubjectEntityIDCriteriaToIdentifierStrategy.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
import java.util.function.Function;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultTrustChainTrustMarksParsingStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultTrustChainTrustMarksParsingStrategy.java
similarity index 80%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultTrustChainTrustMarksParsingStrategy.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultTrustChainTrustMarksParsingStrategy.java
index fb1c5d7..bea3845 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultTrustChainTrustMarksParsingStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultTrustChainTrustMarksParsingStrategy.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
import java.text.ParseException;
import java.util.HashMap;
@@ -26,23 +26,19 @@ import javax.annotation.Nullable;
import org.slf4j.Logger;
-import com.fasterxml.jackson.databind.ObjectMapper;
import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.jwt.SignedJWT;
-import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityConfigurationPayload;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
-import net.shibboleth.shared.component.ComponentInitializationException;
-import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
/**
* Default strategy for parsing map of trust marks for the given trust chain. The keys in the map refer to the entity
* ID for which the trust mark has been issued to.
- *
- * TODO: iat / subject validation (switch into using claims validators)
*/
@ThreadSafeAfterInit
public class DefaultTrustChainTrustMarksParsingStrategy extends AbstractIdentifiableInitializableComponent
@@ -51,27 +47,6 @@ public class DefaultTrustChainTrustMarksParsingStrategy extends AbstractIdentifi
/** Class logger. */
@Nonnull private Logger log = LoggerFactory.getLogger(DefaultTrustChainTrustMarksParsingStrategy.class);
- /** JSON object mapper used for decoding JSON into Map. */
- @NonnullAfterInit private ObjectMapper objectMapper;
-
- /**
- * Set the JSON {@link ObjectMapper} used for decoding JSON into Map.
- *
- * @param mapper object mapper
- */
- public void setObjectMapper(@Nonnull final ObjectMapper mapper) {
- checkSetterPreconditions();
-
- objectMapper = Constraint.isNotNull(mapper, "Object mapper cannot be null");
- }
-
- /** {@inheritDoc} */
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
- if (objectMapper == null) {
- throw new ComponentInitializationException("Object mapper cannot be null");
- }
- }
/** {@inheritDoc} */
@Override @Nullable
public Map<String, List<SignedJWT>> apply(@Nullable final List<EntityStatement> trustChain) {
@@ -87,7 +62,8 @@ public class DefaultTrustChainTrustMarksParsingStrategy extends AbstractIdentifi
if (statement.getParsedPayload() instanceof EntityConfigurationPayload ecp) {
final SignedJWT statementJwt = statement.getJwt();
final List<Map<String, String>> rawTrustMarks = ecp.getTrustMarks();
- log.trace("Inspecting entity statement {} with trust marks {}", statementJwt.serialize(), rawTrustMarks);
+ log.trace("Inspecting entity statement {} with trust marks {}", statementJwt.serialize(),
+ rawTrustMarks);
if (rawTrustMarks != null && !rawTrustMarks.isEmpty()) {
log.trace("Transforming the trust mark into a JWT");
@@ -135,7 +111,8 @@ public class DefaultTrustChainTrustMarksParsingStrategy extends AbstractIdentifi
final SignedJWT jwt = SignedJWT.parse((String) trustMark);
final JWTClaimsSet trustMarkClaims = jwt.getJWTClaimsSet();
if (StringSupport.trimOrNull(trustMarkClaims.getIssuer()) == null) {
- log.error("Trust Mark {} is missing mandatory issuer", trustMarkClaims.getStringClaim("trust_mark_type"));
+ log.error("Trust Mark {} is missing mandatory issuer",
+ trustMarkClaims.getStringClaim("trust_mark_type"));
return null;
}
if (id.equals(trustMarkClaims.getStringClaim("trust_mark_type"))) {
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultTrustChainTrustedTrustMarkIssuersLookupStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultTrustChainTrustedTrustMarkIssuersLookupStrategy.java
similarity index 70%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultTrustChainTrustedTrustMarkIssuersLookupStrategy.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultTrustChainTrustedTrustMarkIssuersLookupStrategy.java
index 70dff7e..8d8b1f3 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultTrustChainTrustedTrustMarkIssuersLookupStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultTrustChainTrustedTrustMarkIssuersLookupStrategy.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
import java.util.List;
import java.util.Map;
@@ -22,43 +22,20 @@ import java.util.stream.Collectors;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
-import com.fasterxml.jackson.databind.ObjectMapper;
-
-import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityConfigurationPayload;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
+import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
-import net.shibboleth.shared.component.ComponentInitializationException;
-import net.shibboleth.shared.logic.Constraint;
/**
* Default function for fetching trusted trust mark issuers from a trust chain: they are read from the trust anchor's
* entity configuration.
*/
+ at ThreadSafeAfterInit
public class DefaultTrustChainTrustedTrustMarkIssuersLookupStrategy extends AbstractIdentifiableInitializableComponent
implements Function<List<EntityStatement>, Map<String, List<String>>> {
- /** JSON object mapper used for decoding JSON into Map. */
- @NonnullAfterInit private ObjectMapper objectMapper;
-
- /**
- * Set the JSON {@link ObjectMapper} used for decoding JSON into Map.
- *
- * @param mapper object mapper
- */
- public void setObjectMapper(@Nonnull final ObjectMapper mapper) {
- checkSetterPreconditions();
-
- objectMapper = Constraint.isNotNull(mapper, "Object mapper cannot be null");
- }
-
- /** {@inheritDoc} */
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
- if (objectMapper == null) {
- throw new ComponentInitializationException("Object mapper cannot be null");
- }
- }
-
/** {@inheritDoc} */
@Nullable @Override
public Map<String, List<String>> apply(@Nullable final List<EntityStatement> trustChain) {
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultTrustChainTrustedTrustMarkOwnersLookupStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultTrustChainTrustedTrustMarkOwnersLookupStrategy.java
similarity index 90%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultTrustChainTrustedTrustMarkOwnersLookupStrategy.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultTrustChainTrustedTrustMarkOwnersLookupStrategy.java
index e9e49d2..7fbf9d1 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultTrustChainTrustedTrustMarkOwnersLookupStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultTrustChainTrustedTrustMarkOwnersLookupStrategy.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
import java.util.List;
import java.util.Map;
@@ -24,6 +24,8 @@ import javax.annotation.concurrent.ThreadSafe;
import org.slf4j.Logger;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityConfigurationPayload;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.primitive.LoggerFactory;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/IssuerEntityIDCriterion.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/IssuerEntityIDCriterion.java
similarity index 97%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/IssuerEntityIDCriterion.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/IssuerEntityIDCriterion.java
index b00b56f..dfbdc85 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/IssuerEntityIDCriterion.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/IssuerEntityIDCriterion.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
import java.util.Objects;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/PreSelectedTrustChainCriterion.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/PreSelectedTrustChainCriterion.java
similarity index 97%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/PreSelectedTrustChainCriterion.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/PreSelectedTrustChainCriterion.java
index 95cbb8d..65431fd 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/PreSelectedTrustChainCriterion.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/PreSelectedTrustChainCriterion.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
import java.util.List;
import java.util.Objects;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/ResponseContainerExpirationCriterion.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/ResponseContainerExpirationCriterion.java
similarity index 97%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/ResponseContainerExpirationCriterion.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/ResponseContainerExpirationCriterion.java
index a969761..3c65d86 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/ResponseContainerExpirationCriterion.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/ResponseContainerExpirationCriterion.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
import java.time.Instant;
import java.util.Objects;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/SignatureValidationKeyContainerJwtCriterion.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/SignatureValidationKeyContainerJwtCriterion.java
similarity index 97%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/SignatureValidationKeyContainerJwtCriterion.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/SignatureValidationKeyContainerJwtCriterion.java
index c1018c4..9f1397f 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/SignatureValidationKeyContainerJwtCriterion.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/SignatureValidationKeyContainerJwtCriterion.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
import java.util.Objects;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/SubjectEntityIDCriterion.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/SubjectEntityIDCriterion.java
similarity index 97%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/SubjectEntityIDCriterion.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/SubjectEntityIDCriterion.java
index 4ca9c45..9f77f2b 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/SubjectEntityIDCriterion.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/SubjectEntityIDCriterion.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
import java.util.Objects;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/SubjectLocallyTrustedKeysCriterion.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/SubjectLocallyTrustedKeysCriterion.java
similarity index 97%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/SubjectLocallyTrustedKeysCriterion.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/SubjectLocallyTrustedKeysCriterion.java
index 56d012e..86b0e73 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/SubjectLocallyTrustedKeysCriterion.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/SubjectLocallyTrustedKeysCriterion.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
import java.util.Objects;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/TrustAnchorEntityIDsCriterion.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/TrustAnchorEntityIDsCriterion.java
similarity index 97%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/TrustAnchorEntityIDsCriterion.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/TrustAnchorEntityIDsCriterion.java
index 97934e8..4884e17 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/TrustAnchorEntityIDsCriterion.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/TrustAnchorEntityIDsCriterion.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
import java.util.List;
import java.util.Objects;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/TrustMarkCriterion.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/TrustMarkCriterion.java
similarity index 96%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/TrustMarkCriterion.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/TrustMarkCriterion.java
index 3bc1f5b..beb25c3 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/TrustMarkCriterion.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/TrustMarkCriterion.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
import java.util.Objects;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/TrustMarkOwnersCriterion.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/TrustMarkOwnersCriterion.java
similarity index 97%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/TrustMarkOwnersCriterion.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/TrustMarkOwnersCriterion.java
index 56a19bb..a17184d 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/TrustMarkOwnersCriterion.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/TrustMarkOwnersCriterion.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
import java.util.Map;
import java.util.Objects;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultEntityConfigurationMetadataSkeletonLookupStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/DefaultEntityConfigurationMetadataSkeletonLookupStrategy.java
similarity index 97%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultEntityConfigurationMetadataSkeletonLookupStrategy.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/DefaultEntityConfigurationMetadataSkeletonLookupStrategy.java
index 91d0dc1..ca6bd90 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultEntityConfigurationMetadataSkeletonLookupStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/DefaultEntityConfigurationMetadataSkeletonLookupStrategy.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local;
import java.util.Map;
import java.util.Optional;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultEntityConfigurationResponseFetchingStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/DefaultEntityConfigurationResponseFetchingStrategy.java
similarity index 93%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultEntityConfigurationResponseFetchingStrategy.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/DefaultEntityConfigurationResponseFetchingStrategy.java
index 1862386..90898c7 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultEntityConfigurationResponseFetchingStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/DefaultEntityConfigurationResponseFetchingStrategy.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local;
import java.util.function.Function;
@@ -21,6 +21,7 @@ import javax.annotation.Nullable;
import org.slf4j.Logger;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.ResponseContainerExpirationCriterion;
import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
import net.shibboleth.shared.primitive.LoggerFactory;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultEntityStatementSignatureValidationFilterStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/DefaultEntityStatementSignatureValidationFilterStrategy.java
similarity index 86%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultEntityStatementSignatureValidationFilterStrategy.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/DefaultEntityStatementSignatureValidationFilterStrategy.java
index 44bdc68..337c2f6 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultEntityStatementSignatureValidationFilterStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/DefaultEntityStatementSignatureValidationFilterStrategy.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local;
import java.util.function.BiFunction;
@@ -22,7 +22,9 @@ import javax.annotation.Nullable;
import org.opensaml.security.trust.TrustEngine;
import org.slf4j.Logger;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityStatementCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.AbstractTrustEngineSignatureValidationComponent;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.SubjectEntityStatementCriterion;
import net.shibboleth.oidc.metadata.filter.MetadataFilterContext;
import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
import net.shibboleth.shared.primitive.LoggerFactory;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultLocalTrustAnchorsValidator.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/DefaultLocalTrustAnchorsValidator.java
similarity index 96%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultLocalTrustAnchorsValidator.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/DefaultLocalTrustAnchorsValidator.java
index 28d9d10..31192c8 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultLocalTrustAnchorsValidator.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/DefaultLocalTrustAnchorsValidator.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local;
import java.util.Map;
import java.util.function.Predicate;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultNimbusResponseContainerExpirationTimeStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/DefaultNimbusResponseContainerExpirationTimeStrategy.java
similarity index 97%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultNimbusResponseContainerExpirationTimeStrategy.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/DefaultNimbusResponseContainerExpirationTimeStrategy.java
index 700a849..58d97f0 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultNimbusResponseContainerExpirationTimeStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/DefaultNimbusResponseContainerExpirationTimeStrategy.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local;
import java.time.Instant;
import java.util.ArrayList;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultResolveEntityRequestCriteriaToIdentifierStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/DefaultResolveEntityRequestCriteriaToIdentifierStrategy.java
similarity index 95%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultResolveEntityRequestCriteriaToIdentifierStrategy.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/DefaultResolveEntityRequestCriteriaToIdentifierStrategy.java
index d2e77ae..81ab3f5 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultResolveEntityRequestCriteriaToIdentifierStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/DefaultResolveEntityRequestCriteriaToIdentifierStrategy.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local;
import java.util.Optional;
import java.util.function.Function;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultResolveEntityResponseFetchingStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/DefaultResolveEntityResponseFetchingStrategy.java
similarity index 94%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultResolveEntityResponseFetchingStrategy.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/DefaultResolveEntityResponseFetchingStrategy.java
index c63e5b8..f8a51e9 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultResolveEntityResponseFetchingStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/DefaultResolveEntityResponseFetchingStrategy.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local;
import java.util.function.Function;
@@ -21,6 +21,7 @@ import javax.annotation.Nullable;
import org.slf4j.Logger;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.ResponseContainerExpirationCriterion;
import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
import net.shibboleth.shared.primitive.LoggerFactory;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultResolveEntityResponseIdentifierExtractionStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/DefaultResolveEntityResponseIdentifierExtractionStrategy.java
similarity index 94%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultResolveEntityResponseIdentifierExtractionStrategy.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/DefaultResolveEntityResponseIdentifierExtractionStrategy.java
index a5009e4..8878d6f 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultResolveEntityResponseIdentifierExtractionStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/DefaultResolveEntityResponseIdentifierExtractionStrategy.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local;
import java.util.Optional;
import java.util.function.Function;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/LocalKeyContainer.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/LocalKeyContainer.java
similarity index 95%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/LocalKeyContainer.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/LocalKeyContainer.java
index 587104f..e18fd84 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/LocalKeyContainer.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/LocalKeyContainer.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local;
import javax.annotation.Nullable;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/NimbusResponseContainer.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/NimbusResponseContainer.java
similarity index 96%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/NimbusResponseContainer.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/NimbusResponseContainer.java
index 188c501..01a94cc 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/NimbusResponseContainer.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/NimbusResponseContainer.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local;
import java.io.Serializable;
import java.time.Instant;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/NimbusResponseCriterion.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/NimbusResponseCriterion.java
similarity index 96%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/NimbusResponseCriterion.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/NimbusResponseCriterion.java
index bcc0dcd..ebaf7ac 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/NimbusResponseCriterion.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/NimbusResponseCriterion.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local;
import java.util.Objects;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/ResolveEntityRequestCriterion.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/ResolveEntityRequestCriterion.java
similarity index 96%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/ResolveEntityRequestCriterion.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/ResolveEntityRequestCriterion.java
index d59a72f..d797b50 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/ResolveEntityRequestCriterion.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/ResolveEntityRequestCriterion.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local;
import java.util.Objects;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/ResolveEntityResponseContainer.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/ResolveEntityResponseContainer.java
similarity index 96%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/ResolveEntityResponseContainer.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/ResolveEntityResponseContainer.java
index edeabe8..f1e5e19 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/ResolveEntityResponseContainer.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/ResolveEntityResponseContainer.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local;
import java.io.Serializable;
import java.time.Instant;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/AbstractFederationEndpointResponseFetchingStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/AbstractFederationEndpointResponseFetchingStrategy.java
similarity index 99%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/AbstractFederationEndpointResponseFetchingStrategy.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/AbstractFederationEndpointResponseFetchingStrategy.java
index 4438bbe..5eb34eb 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/AbstractFederationEndpointResponseFetchingStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/AbstractFederationEndpointResponseFetchingStrategy.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote;
import java.io.IOException;
import java.net.URISyntaxException;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/AbstractTrustEngineSignatureValidationComponent.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/AbstractTrustEngineSignatureValidationComponent.java
similarity index 98%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/AbstractTrustEngineSignatureValidationComponent.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/AbstractTrustEngineSignatureValidationComponent.java
index d47ac17..29c8bb9 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/AbstractTrustEngineSignatureValidationComponent.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/AbstractTrustEngineSignatureValidationComponent.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote;
import java.text.ParseException;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/BaseExpirableEntityStatementContainer.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/BaseExpirableEntityStatementContainer.java
similarity index 97%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/BaseExpirableEntityStatementContainer.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/BaseExpirableEntityStatementContainer.java
index 025fb94..e09653c 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/BaseExpirableEntityStatementContainer.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/BaseExpirableEntityStatementContainer.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote;
import java.io.Serializable;
import java.time.Instant;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/BaseExpirableMetadataContainer.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/BaseExpirableMetadataContainer.java
similarity index 96%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/BaseExpirableMetadataContainer.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/BaseExpirableMetadataContainer.java
index cf156a2..4e50da4 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/BaseExpirableMetadataContainer.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/BaseExpirableMetadataContainer.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote;
import java.io.Serializable;
import java.time.Instant;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultEntityStatementContentValidationCondition.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/DefaultEntityStatementContentValidationCondition.java
similarity index 98%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultEntityStatementContentValidationCondition.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/DefaultEntityStatementContentValidationCondition.java
index f357f51..f3eee5b 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultEntityStatementContentValidationCondition.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/DefaultEntityStatementContentValidationCondition.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote;
import java.text.ParseException;
import java.util.function.BiPredicate;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultEntityStatementMetadataFilterStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/DefaultEntityStatementMetadataFilterStrategy.java
similarity index 97%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultEntityStatementMetadataFilterStrategy.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/DefaultEntityStatementMetadataFilterStrategy.java
index c7c5ac3..2773f00 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultEntityStatementMetadataFilterStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/DefaultEntityStatementMetadataFilterStrategy.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote;
import java.util.List;
import java.util.function.BiFunction;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultEntityStatementSignatureValidationCondition.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/DefaultEntityStatementSignatureValidationCondition.java
similarity index 95%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultEntityStatementSignatureValidationCondition.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/DefaultEntityStatementSignatureValidationCondition.java
index a995083..0e0e379 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultEntityStatementSignatureValidationCondition.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/DefaultEntityStatementSignatureValidationCondition.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote;
import java.util.function.BiPredicate;
import java.util.function.Function;
@@ -23,8 +23,8 @@ import javax.annotation.Nullable;
import org.opensaml.security.trust.TrustEngine;
import org.slf4j.Logger;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.AbstractTrustEngineSignatureValidationComponent;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.AbstractTrustEngineSignatureValidationComponent;
import net.shibboleth.oidc.metadata.filter.MetadataFilterContext;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultEntityStatementValidationCriteriaSetLookupFunction.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/DefaultEntityStatementValidationCriteriaSetLookupFunction.java
similarity index 96%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultEntityStatementValidationCriteriaSetLookupFunction.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/DefaultEntityStatementValidationCriteriaSetLookupFunction.java
index d4075d5..0f61e76 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultEntityStatementValidationCriteriaSetLookupFunction.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/DefaultEntityStatementValidationCriteriaSetLookupFunction.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote;
import java.util.List;
import java.util.function.Function;
@@ -23,7 +23,7 @@ import javax.annotation.Nullable;
import org.slf4j.Logger;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SubjectEntityIDCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityIDCriterion;
import net.shibboleth.oidc.metadata.cache.MetadataCache;
import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultResponseContainerExpirationTimeStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/DefaultResponseContainerExpirationTimeStrategy.java
similarity index 96%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultResponseContainerExpirationTimeStrategy.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/DefaultResponseContainerExpirationTimeStrategy.java
index 8451dcf..5657e59 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultResponseContainerExpirationTimeStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/DefaultResponseContainerExpirationTimeStrategy.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote;
import java.time.Instant;
import java.util.function.Function;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/IssuerEntityStatementCriterion.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/IssuerEntityStatementCriterion.java
similarity index 96%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/IssuerEntityStatementCriterion.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/IssuerEntityStatementCriterion.java
index b46046b..fb74997 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/IssuerEntityStatementCriterion.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/IssuerEntityStatementCriterion.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote;
import java.util.Objects;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/RemoteEntityConfigurationContainer.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/RemoteEntityConfigurationContainer.java
similarity index 96%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/RemoteEntityConfigurationContainer.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/RemoteEntityConfigurationContainer.java
index 9ed1b2a..a29acc7 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/RemoteEntityConfigurationContainer.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/RemoteEntityConfigurationContainer.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote;
import java.io.Serializable;
import java.time.Instant;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/RemoteSubordinateStatementContainer.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/RemoteSubordinateStatementContainer.java
similarity index 97%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/RemoteSubordinateStatementContainer.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/RemoteSubordinateStatementContainer.java
index 9689b77..aac1928 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/RemoteSubordinateStatementContainer.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/RemoteSubordinateStatementContainer.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote;
import java.io.Serializable;
import java.time.Instant;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/RemoteTrustChainsContainer.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/RemoteTrustChainsContainer.java
similarity index 97%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/RemoteTrustChainsContainer.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/RemoteTrustChainsContainer.java
index 3bac744..ec918f6 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/RemoteTrustChainsContainer.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/RemoteTrustChainsContainer.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote;
import java.io.Serializable;
import java.time.Instant;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/SubjectEntityStatementCriterion.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/SubjectEntityStatementCriterion.java
similarity index 96%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/SubjectEntityStatementCriterion.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/SubjectEntityStatementCriterion.java
index 70fd128..f33b235 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/SubjectEntityStatementCriterion.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/SubjectEntityStatementCriterion.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote;
import java.util.Objects;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/SubordinateStatementCacheIdentifier.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/SubordinateStatementCacheIdentifier.java
similarity index 97%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/SubordinateStatementCacheIdentifier.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/SubordinateStatementCacheIdentifier.java
index 6d21536..2719b3f 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/SubordinateStatementCacheIdentifier.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/SubordinateStatementCacheIdentifier.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote;
import java.io.Serializable;
import java.util.Objects;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/ec/DefaultEntityConfigurationCriteriaSetLookupFunction.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/configuration/DefaultEntityConfigurationCriteriaSetLookupFunction.java
similarity index 82%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/ec/DefaultEntityConfigurationCriteriaSetLookupFunction.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/configuration/DefaultEntityConfigurationCriteriaSetLookupFunction.java
index 1ace272..d541ec0 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/ec/DefaultEntityConfigurationCriteriaSetLookupFunction.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/configuration/DefaultEntityConfigurationCriteriaSetLookupFunction.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.ec;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.configuration;
import java.util.Optional;
import java.util.function.Function;
@@ -20,8 +20,8 @@ import java.util.function.Function;
import javax.annotation.Nullable;
import javax.annotation.concurrent.ThreadSafe;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.BaseExpirableEntityStatementContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityStatementCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.BaseExpirableEntityStatementContainer;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.SubjectEntityStatementCriterion;
import net.shibboleth.shared.resolver.CriteriaSet;
/**
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/ec/DefaultEntityConfigurationFetchingStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/configuration/DefaultEntityConfigurationFetchingStrategy.java
similarity index 93%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/ec/DefaultEntityConfigurationFetchingStrategy.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/configuration/DefaultEntityConfigurationFetchingStrategy.java
index 1e52a13..be74702 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/ec/DefaultEntityConfigurationFetchingStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/configuration/DefaultEntityConfigurationFetchingStrategy.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.ec;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.configuration;
import java.io.IOException;
import java.net.URI;
@@ -35,9 +35,9 @@ import com.nimbusds.jose.JOSEObjectType;
import com.nimbusds.jwt.SignedJWT;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityConfiguration;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SubjectEntityIDCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.AbstractFederationEndpointResponseFetchingStrategy;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.RemoteEntityConfigurationContainer;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityIDCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.AbstractFederationEndpointResponseFetchingStrategy;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.RemoteEntityConfigurationContainer;
import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
import net.shibboleth.shared.logic.ConstraintViolationException;
import net.shibboleth.shared.primitive.LoggerFactory;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remoteresolver/DefaultResolveEntityTrustChainFetchingStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/resolver/DefaultResolveEntityTrustChainFetchingStrategy.java
similarity index 97%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remoteresolver/DefaultResolveEntityTrustChainFetchingStrategy.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/resolver/DefaultResolveEntityTrustChainFetchingStrategy.java
index 29fcc1e..4e7ab2c 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remoteresolver/DefaultResolveEntityTrustChainFetchingStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/resolver/DefaultResolveEntityTrustChainFetchingStrategy.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remoteresolver;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.resolver;
import java.io.IOException;
import java.net.URI;
@@ -39,7 +39,7 @@ import com.nimbusds.jose.JOSEObjectType;
import com.nimbusds.jwt.SignedJWT;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.ResolveEntityResponse;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.AbstractFederationEndpointResponseFetchingStrategy;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.AbstractFederationEndpointResponseFetchingStrategy;
import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
import net.shibboleth.shared.logic.ConstraintViolationException;
import net.shibboleth.shared.primitive.LoggerFactory;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remoteresolver/RemoteResolveEntityCacheContainerIdentifier.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/resolver/RemoteResolveEntityCacheContainerIdentifier.java
similarity index 99%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remoteresolver/RemoteResolveEntityCacheContainerIdentifier.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/resolver/RemoteResolveEntityCacheContainerIdentifier.java
index 9e00ca9..c937b9b 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remoteresolver/RemoteResolveEntityCacheContainerIdentifier.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/resolver/RemoteResolveEntityCacheContainerIdentifier.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remoteresolver;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.resolver;
import java.io.Serializable;
import java.util.List;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remoteresolver/RemoteResolveEntityCacheIdentifierCriterion.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/resolver/RemoteResolveEntityCacheIdentifierCriterion.java
similarity index 99%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remoteresolver/RemoteResolveEntityCacheIdentifierCriterion.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/resolver/RemoteResolveEntityCacheIdentifierCriterion.java
index 04da259..bc057b7 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remoteresolver/RemoteResolveEntityCacheIdentifierCriterion.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/resolver/RemoteResolveEntityCacheIdentifierCriterion.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remoteresolver;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.resolver;
import java.util.Objects;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remoteresolver/RemoteResolveEntityResponseContainer.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/resolver/RemoteResolveEntityResponseContainer.java
similarity index 95%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remoteresolver/RemoteResolveEntityResponseContainer.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/resolver/RemoteResolveEntityResponseContainer.java
index 6f88635..afa88a8 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remoteresolver/RemoteResolveEntityResponseContainer.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/resolver/RemoteResolveEntityResponseContainer.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remoteresolver;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.resolver;
import java.io.Serializable;
import java.time.Instant;
@@ -21,7 +21,7 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.ResolveEntityResponse;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.BaseExpirableEntityStatementContainer;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.BaseExpirableEntityStatementContainer;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.logic.Constraint;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/ss/DefaultSubordinateStatementCriteriaToIdentifierStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/subordinate/DefaultSubordinateStatementCriteriaToIdentifierStrategy.java
similarity index 95%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/ss/DefaultSubordinateStatementCriteriaToIdentifierStrategy.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/subordinate/DefaultSubordinateStatementCriteriaToIdentifierStrategy.java
index a942b37..d5b4b4c 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/ss/DefaultSubordinateStatementCriteriaToIdentifierStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/subordinate/DefaultSubordinateStatementCriteriaToIdentifierStrategy.java
@@ -12,14 +12,14 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.ss;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.subordinate;
import java.util.function.Function;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubordinateStatementCacheIdentifier;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.SubordinateStatementCacheIdentifier;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/ss/DefaultSubordinateStatementFetchingStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/subordinate/DefaultSubordinateStatementFetchingStrategy.java
similarity index 93%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/ss/DefaultSubordinateStatementFetchingStrategy.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/subordinate/DefaultSubordinateStatementFetchingStrategy.java
index f726bfb..34cb673 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/ss/DefaultSubordinateStatementFetchingStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/subordinate/DefaultSubordinateStatementFetchingStrategy.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.ss;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.subordinate;
import java.io.IOException;
import java.net.URI;
@@ -38,13 +38,13 @@ import com.nimbusds.jose.JOSEObjectType;
import com.nimbusds.jwt.SignedJWT;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.IssuerEntityIDCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SubjectEntityIDCriterion;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SubordinateStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.AbstractFederationEndpointResponseFetchingStrategy;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.RemoteEntityConfigurationContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.RemoteSubordinateStatementContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubordinateStatementCacheIdentifier;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.IssuerEntityIDCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityIDCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.AbstractFederationEndpointResponseFetchingStrategy;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.RemoteEntityConfigurationContainer;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.RemoteSubordinateStatementContainer;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.SubordinateStatementCacheIdentifier;
import net.shibboleth.oidc.metadata.cache.MetadataCache;
import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/tc/DefaultRemoteTrustChainSignatureValidationFilterStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/trustchain/DefaultRemoteTrustChainSignatureValidationFilterStrategy.java
similarity index 93%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/tc/DefaultRemoteTrustChainSignatureValidationFilterStrategy.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/trustchain/DefaultRemoteTrustChainSignatureValidationFilterStrategy.java
index cd1d8f0..9e3c07f 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/tc/DefaultRemoteTrustChainSignatureValidationFilterStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/trustchain/DefaultRemoteTrustChainSignatureValidationFilterStrategy.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.tc;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.trustchain;
import java.util.List;
import java.util.function.BiFunction;
@@ -25,10 +25,10 @@ import org.slf4j.Logger;
import com.nimbusds.jwt.SignedJWT;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.AbstractTrustEngineSignatureValidationComponent;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SignatureValidationKeyContainerJwtCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.RemoteTrustChainsContainer;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.AbstractTrustEngineSignatureValidationComponent;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SignatureValidationKeyContainerJwtCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.RemoteTrustChainsContainer;
import net.shibboleth.oidc.metadata.filter.MetadataFilterContext;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/tc/DefaultTrustChainFetchingStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/trustchain/DefaultTrustChainFetchingStrategy.java
similarity index 95%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/tc/DefaultTrustChainFetchingStrategy.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/trustchain/DefaultTrustChainFetchingStrategy.java
index a0eca13..ef41b86 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/tc/DefaultTrustChainFetchingStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/trustchain/DefaultTrustChainFetchingStrategy.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.tc;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.trustchain;
import java.time.Duration;
import java.time.Instant;
@@ -33,15 +33,15 @@ import com.fasterxml.jackson.databind.ObjectMapper;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityConfiguration;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityConfigurationPayload;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.IssuerEntityIDCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.LocalKeyContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.PreSelectedTrustChainCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SubjectEntityIDCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.BaseExpirableEntityStatementContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.RemoteEntityConfigurationContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.RemoteSubordinateStatementContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.RemoteTrustChainsContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityStatementCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.IssuerEntityIDCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.PreSelectedTrustChainCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityIDCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.LocalKeyContainer;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.BaseExpirableEntityStatementContainer;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.RemoteEntityConfigurationContainer;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.RemoteSubordinateStatementContainer;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.RemoteTrustChainsContainer;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.SubjectEntityStatementCriterion;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.constraints.FederationPolicyConstraint;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.constraints.FederationPolicyConstraintHelper;
import net.shibboleth.oidc.metadata.cache.MetadataCache;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultTrustChainSubjectIdentifierExtractionStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/trustchain/DefaultTrustChainSubjectIdentifierExtractionStrategy.java
similarity index 90%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultTrustChainSubjectIdentifierExtractionStrategy.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/trustchain/DefaultTrustChainSubjectIdentifierExtractionStrategy.java
index 030890c..9442ba5 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultTrustChainSubjectIdentifierExtractionStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/trustchain/DefaultTrustChainSubjectIdentifierExtractionStrategy.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.trustchain;
import java.util.List;
import java.util.function.Function;
@@ -20,6 +20,8 @@ import java.util.function.Function;
import javax.annotation.Nullable;
import javax.annotation.concurrent.ThreadSafe;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
+
/**
* Default identifier strategy for the list of trust chains: the entity ID of the leaf entity is always used.
*/
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/tm/DefaultTrustMarkFetchingStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/trustmark/DefaultTrustMarkFetchingStrategy.java
similarity index 97%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/tm/DefaultTrustMarkFetchingStrategy.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/trustmark/DefaultTrustMarkFetchingStrategy.java
index eae898c..427fa81 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/tm/DefaultTrustMarkFetchingStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/trustmark/DefaultTrustMarkFetchingStrategy.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.tm;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.trustmark;
import java.io.IOException;
import java.net.URI;
@@ -39,7 +39,7 @@ import com.nimbusds.jose.JOSEObjectType;
import com.nimbusds.jwt.SignedJWT;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.TrustMark;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.AbstractFederationEndpointResponseFetchingStrategy;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.AbstractFederationEndpointResponseFetchingStrategy;
import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
import net.shibboleth.shared.logic.ConstraintViolationException;
import net.shibboleth.shared.primitive.LoggerFactory;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/tm/DefaultTrustMarkStatusFetchingStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/trustmark/DefaultTrustMarkStatusFetchingStrategy.java
similarity index 97%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/tm/DefaultTrustMarkStatusFetchingStrategy.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/trustmark/DefaultTrustMarkStatusFetchingStrategy.java
index 95d0450..bb99888 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/tm/DefaultTrustMarkStatusFetchingStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/trustmark/DefaultTrustMarkStatusFetchingStrategy.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.tm;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.trustmark;
import java.io.IOException;
import java.nio.charset.StandardCharsets;
@@ -40,7 +40,7 @@ import com.nimbusds.jose.JOSEObjectType;
import com.nimbusds.jwt.SignedJWT;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.TrustMarkStatus;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.AbstractFederationEndpointResponseFetchingStrategy;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.AbstractFederationEndpointResponseFetchingStrategy;
import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
import net.shibboleth.shared.logic.ConstraintViolationException;
import net.shibboleth.shared.primitive.LoggerFactory;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/tm/DefaultTrustMarkValidationCriteriaSetLookupFunction.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/trustmark/DefaultTrustMarkValidationCriteriaSetLookupFunction.java
similarity index 91%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/tm/DefaultTrustMarkValidationCriteriaSetLookupFunction.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/trustmark/DefaultTrustMarkValidationCriteriaSetLookupFunction.java
index 5ca22ca..899b4b7 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/tm/DefaultTrustMarkValidationCriteriaSetLookupFunction.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/trustmark/DefaultTrustMarkValidationCriteriaSetLookupFunction.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.tm;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.trustmark;
import java.util.List;
import java.util.function.Function;
@@ -23,11 +23,11 @@ import javax.annotation.Nullable;
import org.slf4j.Logger;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SubjectEntityIDCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.BaseExpirableEntityStatementContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.IssuerEntityStatementCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.RemoteTrustChainsContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityStatementCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityIDCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.BaseExpirableEntityStatementContainer;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.IssuerEntityStatementCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.RemoteTrustChainsContainer;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.SubjectEntityStatementCriterion;
import net.shibboleth.oidc.metadata.cache.MetadataCache;
import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/tm/RemoteTrustMarkContainer.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/trustmark/RemoteTrustMarkContainer.java
similarity index 94%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/tm/RemoteTrustMarkContainer.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/trustmark/RemoteTrustMarkContainer.java
index 87036da..626130d 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/tm/RemoteTrustMarkContainer.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/trustmark/RemoteTrustMarkContainer.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.tm;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.trustmark;
import java.io.Serializable;
import java.time.Instant;
@@ -21,7 +21,7 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.TrustMark;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.BaseExpirableEntityStatementContainer;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.BaseExpirableEntityStatementContainer;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.logic.Constraint;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/tm/RemoteTrustMarkStatusContainer.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/trustmark/RemoteTrustMarkStatusContainer.java
similarity index 95%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/tm/RemoteTrustMarkStatusContainer.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/trustmark/RemoteTrustMarkStatusContainer.java
index a2b5234..c042221 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/tm/RemoteTrustMarkStatusContainer.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/trustmark/RemoteTrustMarkStatusContainer.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.tm;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.trustmark;
import java.io.Serializable;
import java.time.Instant;
@@ -21,7 +21,7 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.TrustMarkStatus;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.BaseExpirableEntityStatementContainer;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.BaseExpirableEntityStatementContainer;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.logic.Constraint;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/tm/TrustMarkCacheIdentifier.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/trustmark/TrustMarkCacheIdentifier.java
similarity index 99%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/tm/TrustMarkCacheIdentifier.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/trustmark/TrustMarkCacheIdentifier.java
index 67efa09..75bb22d 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/tm/TrustMarkCacheIdentifier.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/trustmark/TrustMarkCacheIdentifier.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.tm;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.trustmark;
import java.io.Serializable;
import java.util.Objects;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/tm/TrustMarkIdentifierCriterion.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/trustmark/TrustMarkIdentifierCriterion.java
similarity index 99%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/tm/TrustMarkIdentifierCriterion.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/trustmark/TrustMarkIdentifierCriterion.java
index 512a9f0..4045f40 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/tm/TrustMarkIdentifierCriterion.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/trustmark/TrustMarkIdentifierCriterion.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.tm;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.trustmark;
import java.util.Objects;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/tm/TrustMarkStatusCacheIdentifier.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/trustmark/TrustMarkStatusCacheIdentifier.java
similarity index 99%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/tm/TrustMarkStatusCacheIdentifier.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/trustmark/TrustMarkStatusCacheIdentifier.java
index 3b56153..7d066e1 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/tm/TrustMarkStatusCacheIdentifier.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/trustmark/TrustMarkStatusCacheIdentifier.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.tm;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.trustmark;
import java.io.Serializable;
import java.util.Objects;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/tm/TrustMarkStatusIdentifierCriterion.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/trustmark/TrustMarkStatusIdentifierCriterion.java
similarity index 99%
rename from idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/tm/TrustMarkStatusIdentifierCriterion.java
rename to idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/trustmark/TrustMarkStatusIdentifierCriterion.java
index 4a2f9f2..4b69075 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/tm/TrustMarkStatusIdentifierCriterion.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/remote/trustmark/TrustMarkStatusIdentifierCriterion.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.tm;
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.trustmark;
import java.util.Objects;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/jackson/LocalKeyContainerDeserializer.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/jackson/LocalKeyContainerDeserializer.java
index 18c6523..b30af43 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/jackson/LocalKeyContainerDeserializer.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/jackson/LocalKeyContainerDeserializer.java
@@ -28,7 +28,7 @@ import com.fasterxml.jackson.databind.DeserializationContext;
import com.fasterxml.jackson.databind.JsonDeserializer;
import com.nimbusds.jose.jwk.JWKSet;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.LocalKeyContainer;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.LocalKeyContainer;
import net.shibboleth.shared.primitive.LoggerFactory;
/**
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/util/EntityStatementHelper.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/util/EntityStatementHelper.java
new file mode 100644
index 0000000..8689c2b
--- /dev/null
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/util/EntityStatementHelper.java
@@ -0,0 +1,96 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.util;
+
+import java.net.URI;
+import java.util.List;
+import java.util.Optional;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.slf4j.Logger;
+
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityIDCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.RemoteEntityConfigurationContainer;
+import net.shibboleth.oidc.metadata.cache.MetadataCache;
+import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
+import net.shibboleth.shared.primitive.LoggerFactory;
+import net.shibboleth.shared.resolver.CriteriaSet;
+
+/**
+ * Static utility method related to entity statements.
+ */
+public class EntityStatementHelper {
+
+ /** Class logger. */
+ @Nonnull private final static Logger log = LoggerFactory.getLogger(EntityStatementHelper.class);
+
+ /**
+ * Serialize the given trust chain into a comma-separated list of strings.
+ *
+ * @param trustChain input trust chain
+ * @return serialized trust chain
+ */
+ @Nullable
+ public static String getSerializedTrustChain(@Nullable final List<EntityStatement> trustChain) {
+ return trustChain == null ? null :
+ String.join(",", trustChain.stream().map(es -> es.getJwt().serialize()).toList());
+ }
+
+ /**
+ * Serialize the given entity statement into a string.
+ *
+ * @param entityStatement input entity statement
+ * @return serialized entity statement
+ */
+ @Nullable
+ public static String getSerializedEntityStatement(@Nullable final EntityStatement entityStatement) {
+ return entityStatement == null ? null : entityStatement.getJwt().serialize();
+ }
+
+ /**
+ * Fetch the endpoint URI for the given endpoint ID from a federation_entity metadata. The entity statement is
+ * fetched from the given cache by using the given entity ID as {@link SubjectEntityIDCriterion}.
+ *
+ * @param cache metadata cache used for fetching the entity configuration
+ * @param entityId entity ID of the entity
+ * @param endpointId the endpoint ID
+ * @return endpoint URI
+ */
+ @Nullable public static URI fetchEndpointUriFromFederationEntity(
+ @Nonnull MetadataCache<RemoteEntityConfigurationContainer> cache,
+ @Nonnull final String entityId, @Nonnull final String endpointId) {
+ final CriteriaSet criteria = new CriteriaSet(new SubjectEntityIDCriterion(entityId));
+ try {
+ final List<RemoteEntityConfigurationContainer> result = cache.get(criteria);
+ if (!result.isEmpty()) {
+ return Optional.ofNullable(result.get(0).getEntityStatement())
+ .map(statement -> statement.getParsedPayload().getMetadata())
+ .map(metadata -> metadata.get("federation_entity"))
+ .map(map -> map.get(endpointId))
+ .filter(String.class::isInstance)
+ .map(String.class::cast)
+ .map(URI::create)
+ .orElse(null);
+ }
+ } catch (final MetadataCacheException e) {
+ log.debug("Error while fetching entity configuration for {}", entityId, e);
+ }
+ log.warn("Could not fetch entity configuration for {}", entityId);
+ return null;
+ }
+}
\ No newline at end of file
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildResolveEntityErrorResponseFromEvent.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildResolveEntityErrorResponseFromEvent.java
index cade5f2..3b61241 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildResolveEntityErrorResponseFromEvent.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildResolveEntityErrorResponseFromEvent.java
@@ -35,10 +35,10 @@ import com.nimbusds.oauth2.sdk.ErrorResponse;
import com.nimbusds.oauth2.sdk.http.HTTPResponse;
import net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl.ResolveEntityRequest;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.NimbusResponseCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.ResolveEntityRequestCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.ResolveEntityResponseContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.ResponseContainerExpirationCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.ResponseContainerExpirationCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.NimbusResponseCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.ResolveEntityRequestCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.ResolveEntityResponseContainer;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.navigate.CachedErrorResponseLifetimeLookupFunction;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.oidc.metadata.cache.MetadataCache;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/CallResolveEntityApi.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/CallResolveEntityApi.java
index a21ba8e..1347221 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/CallResolveEntityApi.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/CallResolveEntityApi.java
@@ -48,13 +48,13 @@ import net.shibboleth.idp.authn.AuthnEventIds;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.ResolveEntityResponse;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.ResolveEntityResponsePayload;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.ResponseContainerExpirationCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SubjectEntityIDCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.RemoteEntityConfigurationContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityStatementCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remoteresolver.RemoteResolveEntityCacheContainerIdentifier;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remoteresolver.RemoteResolveEntityCacheIdentifierCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remoteresolver.RemoteResolveEntityResponseContainer;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.ResponseContainerExpirationCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityIDCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.RemoteEntityConfigurationContainer;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.SubjectEntityStatementCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.resolver.RemoteResolveEntityCacheContainerIdentifier;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.resolver.RemoteResolveEntityCacheIdentifierCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.resolver.RemoteResolveEntityResponseContainer;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.TrustedRemoteResolverEntity;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.context.RelyingPartyTrustChainContext;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate.DefaultPreSelectedTrustChainIDsLookupStrategy;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/DefaultTrustMarkFromMetadataCacheFetchingFunction.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/DefaultTrustMarkFromMetadataCacheFetchingFunction.java
index 4882312..ed23c58 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/DefaultTrustMarkFromMetadataCacheFetchingFunction.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/DefaultTrustMarkFromMetadataCacheFetchingFunction.java
@@ -29,13 +29,13 @@ import org.slf4j.Logger;
import com.fasterxml.jackson.databind.ObjectMapper;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatementHelper;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.ResponseContainerExpirationCriterion;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.TrustMark;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.RemoteEntityConfigurationContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.tm.RemoteTrustMarkContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.tm.TrustMarkCacheIdentifier;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.tm.TrustMarkIdentifierCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.ResponseContainerExpirationCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.RemoteEntityConfigurationContainer;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.trustmark.RemoteTrustMarkContainer;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.trustmark.TrustMarkCacheIdentifier;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.trustmark.TrustMarkIdentifierCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.util.EntityStatementHelper;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.TrustedRemoteEntity;
import net.shibboleth.oidc.metadata.cache.MetadataCache;
import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/FormOutboundFederationConfigurationResponse.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/FormOutboundFederationConfigurationResponse.java
index ab8f7a8..8db787c 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/FormOutboundFederationConfigurationResponse.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/FormOutboundFederationConfigurationResponse.java
@@ -35,9 +35,9 @@ import com.nimbusds.oauth2.sdk.Response;
import com.nimbusds.openid.connect.sdk.federation.config.FederationEntityConfigurationSuccessResponse;
import com.nimbusds.openid.connect.sdk.federation.entities.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.NimbusResponseContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.NimbusResponseCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.ResponseContainerExpirationCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.ResponseContainerExpirationCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.NimbusResponseContainer;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.NimbusResponseCriterion;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.navigate.CachedSuccessResponseLifetimeLookupFunction;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.oidc.metadata.cache.MetadataCache;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/FormOutboundResolveEntityResponse.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/FormOutboundResolveEntityResponse.java
index 5d57004..e671a97 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/FormOutboundResolveEntityResponse.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/FormOutboundResolveEntityResponse.java
@@ -35,11 +35,11 @@ import com.nimbusds.openid.connect.sdk.federation.entities.EntityStatement;
import net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl.ResolveEntityRequest;
import net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl.ResolveEntityResponse;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.ResponseContainerExpirationCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.ResponseContainerExpirationCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.NimbusResponseCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.ResolveEntityRequestCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.ResolveEntityResponseContainer;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.navigate.CachedSuccessResponseLifetimeLookupFunction;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.ResolveEntityRequestCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.ResolveEntityResponseContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.NimbusResponseCriterion;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.oidc.metadata.cache.MetadataCache;
import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/LookupCachedEntityConfigurationResponse.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/LookupCachedEntityConfigurationResponse.java
index 9e02bc7..9b1de1d 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/LookupCachedEntityConfigurationResponse.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/LookupCachedEntityConfigurationResponse.java
@@ -25,7 +25,7 @@ import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.NimbusResponseContainer;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.NimbusResponseContainer;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.oidc.metadata.cache.MetadataCache;
import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/LookupCachedResolveEntityResponse.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/LookupCachedResolveEntityResponse.java
index 2550e0f..f4b8e01 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/LookupCachedResolveEntityResponse.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/LookupCachedResolveEntityResponse.java
@@ -27,8 +27,8 @@ import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
import org.slf4j.Logger;
import net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl.ResolveEntityRequest;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.ResolveEntityRequestCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.ResolveEntityResponseContainer;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.ResolveEntityRequestCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.ResolveEntityResponseContainer;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.oidc.metadata.cache.MetadataCache;
import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ResolveTrustChains.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ResolveTrustChains.java
index ca1f133..5467f4d 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ResolveTrustChains.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ResolveTrustChains.java
@@ -35,9 +35,9 @@ import com.nimbusds.oauth2.sdk.id.ClientID;
import net.shibboleth.idp.authn.AuthnEventIds;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityConfiguration;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SubjectEntityIDCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.RemoteTrustChainsContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityStatementCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityIDCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.RemoteTrustChainsContainer;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.SubjectEntityStatementCriterion;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.context.RelyingPartyTrustChainContext;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate.DefaultPreSelectedTrustChainIDsLookupStrategy;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate.DefaultTrustChainIDsLookupStrategy;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ResolveTrustMarks.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ResolveTrustMarks.java
index 3a69a4a..f975add 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ResolveTrustMarks.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ResolveTrustMarks.java
@@ -40,10 +40,10 @@ import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.jwt.SignedJWT;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SubjectEntityIDCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.TrustMarkOwnersCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.RemoteTrustChainsContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityStatementCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityIDCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.TrustMarkOwnersCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.RemoteTrustChainsContainer;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.SubjectEntityStatementCriterion;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.context.RelyingPartyTrustChainContext;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ValidateResolveEntityRequest.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ValidateResolveEntityRequest.java
index 87c3a0c..06c53a4 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ValidateResolveEntityRequest.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ValidateResolveEntityRequest.java
@@ -32,8 +32,8 @@ import org.slf4j.Logger;
import com.nimbusds.oauth2.sdk.Request;
import net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl.ResolveEntityRequest;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.LocalKeyContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SubjectEntityIDCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityIDCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.LocalKeyContainer;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.oidc.metadata.cache.MetadataCache;
import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ValidateSelectedTrustChain.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ValidateSelectedTrustChain.java
index 40139e3..04cc4ce 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ValidateSelectedTrustChain.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ValidateSelectedTrustChain.java
@@ -28,8 +28,8 @@ import org.slf4j.Logger;
import net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl.ResolveEntityRequest;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SubjectEntityIDCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.RemoteEntityConfigurationContainer;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityIDCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.RemoteEntityConfigurationContainer;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.context.RelyingPartyTrustChainContext;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.oidc.metadata.cache.MetadataCache;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultTrustAnchorHintsLookupStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultTrustAnchorHintsLookupStrategy.java
index b9090e9..8b2c146 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultTrustAnchorHintsLookupStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultTrustAnchorHintsLookupStrategy.java
@@ -25,7 +25,7 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.LocalKeyContainer;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.LocalKeyContainer;
import net.shibboleth.oidc.metadata.cache.MetadataCache;
import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultTrustChainMetadataPolicyMergingStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultTrustChainMetadataPolicyMergingStrategy.java
index 4c02322..019ddc1 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultTrustChainMetadataPolicyMergingStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultTrustChainMetadataPolicyMergingStrategy.java
@@ -23,36 +23,27 @@ import java.util.function.Function;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
-import org.slf4j.Logger;
-
-import com.fasterxml.jackson.core.JsonProcessingException;
-import com.fasterxml.jackson.databind.JavaType;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.fasterxml.jackson.databind.type.MapType;
-
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SubordinateStatementPayload;
import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.collection.Pair;
import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.logic.ConstraintViolationException;
-import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
/**
* Default strategy to merge the metadata policies for the given entity type from the given trust chain. Finally,
* a configurable local metadata policy is merged to the resulting map of metadata policies.
*/
+ at ThreadSafeAfterInit
public class DefaultTrustChainMetadataPolicyMergingStrategy extends AbstractIdentifiableInitializableComponent
implements BiFunction<List<EntityStatement>,String, Map<String, MetadataPolicy>> {
- /** Class logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(DefaultTrustChainMetadataPolicyMergingStrategy.class);
-
/** The strategy used for merging two metadata policies. */
@NonnullAfterInit private BiFunction<Map<String, MetadataPolicy>, Map<String, MetadataPolicy>,
Pair<Map<String, MetadataPolicy>, Boolean>> metadataPolicyMergingStrategy;
@@ -61,9 +52,6 @@ public class DefaultTrustChainMetadataPolicyMergingStrategy extends AbstractIden
@NonnullAfterInit private Function<List<EntityStatement>, Map<String, MetadataPolicy>>
localMetadataPolicyStrategy;
- /** Object mapper used for deserializing metadata policies. */
- @NonnullAfterInit private ObjectMapper objectMapper;
-
/**
* Set the strategy used for merging two metadata policies.
*
@@ -88,16 +76,6 @@ public class DefaultTrustChainMetadataPolicyMergingStrategy extends AbstractIden
"Local metadata policy strategy cannot be null");
}
- /**
- * Set the object mapper used for deserializing metadata policies
- *
- * @param mapper What to set.
- */
- public void setObjectMapper(@Nonnull final ObjectMapper mapper) {
- checkSetterPreconditions();
- objectMapper = Constraint.isNotNull(mapper, "Object mapper cannot be null");
- }
-
/** {@inheritDoc} */
protected void doInitialize() throws ComponentInitializationException {
super.doInitialize();
@@ -108,9 +86,6 @@ public class DefaultTrustChainMetadataPolicyMergingStrategy extends AbstractIden
if (localMetadataPolicyStrategy == null) {
throw new ComponentInitializationException("Local metadata policy strategy cannot be null");
}
- if (objectMapper == null) {
- throw new ComponentInitializationException("Object mapper cannot be null");
- }
}
/** {@inheritDoc} */
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/DefaultEntityConfigurationCredentialResolver.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/DefaultEntityConfigurationCredentialResolver.java
index eaa33eb..4dfad32 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/DefaultEntityConfigurationCredentialResolver.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/DefaultEntityConfigurationCredentialResolver.java
@@ -25,7 +25,7 @@ import org.slf4j.Logger;
import com.nimbusds.jose.jwk.JWKSet;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityStatementCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.SubjectEntityStatementCriterion;
import net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver;
import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.resolver.CriteriaSet;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/DefaultLocalTrustAnchorCredentialResolver.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/DefaultLocalTrustAnchorCredentialResolver.java
index aedce1c..fa78c9e 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/DefaultLocalTrustAnchorCredentialResolver.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/DefaultLocalTrustAnchorCredentialResolver.java
@@ -27,8 +27,8 @@ import org.slf4j.Logger;
import com.nimbusds.jose.jwk.JWK;
import com.nimbusds.jose.jwk.JWKSet;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.LocalKeyContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityStatementCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.LocalKeyContainer;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.SubjectEntityStatementCriterion;
import net.shibboleth.oidc.metadata.cache.MetadataCache;
import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
import net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/DefaultPayloadSignatureValidationCredentialResolver.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/DefaultPayloadSignatureValidationCredentialResolver.java
index a4b4f41..862106e 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/DefaultPayloadSignatureValidationCredentialResolver.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/DefaultPayloadSignatureValidationCredentialResolver.java
@@ -27,7 +27,7 @@ import org.slf4j.Logger;
import com.nimbusds.jose.jwk.JWKSet;
import com.nimbusds.jwt.SignedJWT;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SignatureValidationKeyContainerJwtCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SignatureValidationKeyContainerJwtCriterion;
import net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver;
import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.primitive.LoggerFactory;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/DefaultSubordinateStatementCredentialResolver.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/DefaultSubordinateStatementCredentialResolver.java
index 827cbef..e8c3923 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/DefaultSubordinateStatementCredentialResolver.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/DefaultSubordinateStatementCredentialResolver.java
@@ -25,8 +25,8 @@ import org.slf4j.Logger;
import com.nimbusds.jose.jwk.JWKSet;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.IssuerEntityStatementCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityStatementCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.IssuerEntityStatementCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.SubjectEntityStatementCriterion;
import net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver;
import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.resolver.CriteriaSet;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/DefaultTrustMarkOwnerCredentialResolver.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/DefaultTrustMarkOwnerCredentialResolver.java
index cbd258a..d2176be 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/DefaultTrustMarkOwnerCredentialResolver.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/DefaultTrustMarkOwnerCredentialResolver.java
@@ -29,8 +29,8 @@ import org.slf4j.Logger;
import com.nimbusds.jose.jwk.JWK;
import com.nimbusds.jose.jwk.JWKSet;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SubjectEntityIDCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.TrustMarkOwnersCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityIDCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.TrustMarkOwnersCriterion;
import net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver;
import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.primitive.LoggerFactory;
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index ac97b8c..1c75a39 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -84,7 +84,7 @@
</bean>
<bean id="DefaultResponseContainerExpirationTimeStrategy"
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultResponseContainerExpirationTimeStrategy"/>
+ class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.DefaultResponseContainerExpirationTimeStrategy"/>
<bean id="shibboleth.oidfed.EntityConfigurationMetadataCacheBuilderSpec"
class="net.shibboleth.oidc.metadata.cache.impl.DynamicMetadataCacheBuilderSpec"
@@ -96,7 +96,7 @@
<bean parent="shibboleth.Functions.Expression" c:expression="#input?.getEntityId()"/>
</property>
<property name="fetchStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.ec.DefaultEntityConfigurationFetchingStrategy"
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.configuration.DefaultEntityConfigurationFetchingStrategy"
p:httpClient="#{getObject('shibboleth.oidfed.HttpClient') ?: getObject('shibboleth.InternalHttpClient')}"
p:httpClientSecurityParameters="#{getObject('shibboleth.oidfed.NonBrowser.HttpClientSecurityParameters')}"
p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper">
@@ -117,16 +117,16 @@
</bean>
</property>
<property name="metadataFilterStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementMetadataFilterStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.DefaultEntityStatementMetadataFilterStrategy">
<property name="validationConditions">
<util:list value-type="java.util.function.BiPredicate">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementSignatureValidationCondition"
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.DefaultEntityStatementSignatureValidationCondition"
p:trustEngine-ref="shibboleth.oidfed.DefaultEntityConfigurationTrustEngine">
<property name="criteriaSetLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.ec.DefaultEntityConfigurationCriteriaSetLookupFunction"/>
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.configuration.DefaultEntityConfigurationCriteriaSetLookupFunction"/>
</property>
</bean>
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementContentValidationCondition"
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.DefaultEntityStatementContentValidationCondition"
p:claimsValidator-ref="%{idp.oidfed.entityConfiguration.claimsValidator:shibboleth.oidfed.DefaultEntityConfigurationClaimsValidator}"/>
</util:list>
</property>
@@ -185,10 +185,7 @@
</bean>
<bean id="shibboleth.oidfed.DefaultSubjectEntityIDCriteriaToIdentifierStrategy"
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.DefaultSubjectEntityIDCriteriaToIdentifierStrategy" />
-
- <bean id="shibboleth.oidfed.DefaultEntityStatementExpirationTimeStrategy"
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.DefaultEntityStatementExpirationTimeStrategy"/>
+ class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultSubjectEntityIDCriteriaToIdentifierStrategy" />
<bean id="shibboleth.oidfed.SubordinateEntityStatementMetadataCacheBuilderSpec"
class="net.shibboleth.oidc.metadata.cache.impl.DynamicMetadataCacheBuilderSpec"
@@ -199,32 +196,32 @@
<bean parent="shibboleth.Functions.Expression" c:expression="#input?.getIdentifier()"/>
</property>
<property name="criteriaToIdentifierStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.ss.DefaultSubordinateStatementCriteriaToIdentifierStrategy"
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.subordinate.DefaultSubordinateStatementCriteriaToIdentifierStrategy"
p:criteriaToSubjectEntityIdStrategy-ref="shibboleth.oidfed.DefaultSubjectEntityIDCriteriaToIdentifierStrategy">
<property name="criteriaToIssuerEntityIdStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.DefaultIssuerEntityIDCriteriaToIdentifierStrategy"/>
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultIssuerEntityIDCriteriaToIdentifierStrategy"/>
</property>
</bean>
</property>
<property name="metadataFilterStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementMetadataFilterStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.DefaultEntityStatementMetadataFilterStrategy">
<property name="validationConditions">
<util:list value-type="java.util.function.BiPredicate">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementSignatureValidationCondition"
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.DefaultEntityStatementSignatureValidationCondition"
p:trustEngine-ref="shibboleth.oidfed.DefaultSubordinateStatementTrustEngine">
<property name="criteriaSetLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementValidationCriteriaSetLookupFunction"
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.DefaultEntityStatementValidationCriteriaSetLookupFunction"
p:entityConfigurationCache-ref="shibboleth.oidfed.EntityConfigurationMetadataCache"/>
</property>
</bean>
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementContentValidationCondition"
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.DefaultEntityStatementContentValidationCondition"
p:claimsValidator-ref="%{idp.oidfed.subordinateStatement.claimsValidator:shibboleth.oidfed.DefaultSubordinateStatementClaimsValidator}"/>
</util:list>
</property>
</bean>
</property>
<property name="fetchStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.ss.DefaultSubordinateStatementFetchingStrategy"
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.subordinate.DefaultSubordinateStatementFetchingStrategy"
p:httpClient="#{getObject('shibboleth.oidfed.HttpClient') ?: getObject('shibboleth.InternalHttpClient')}"
p:httpClientSecurityParameters="#{getObject('shibboleth.oidfed.NonBrowser.HttpClientSecurityParameters')}"
p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper"
@@ -289,7 +286,7 @@
<bean parent="shibboleth.Functions.Expression" c:expression="#input?.getEntityId()"/>
</property>
<property name="metadataFilterStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.tc.DefaultRemoteTrustChainSignatureValidationFilterStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.trustchain.DefaultRemoteTrustChainSignatureValidationFilterStrategy">
<property name="trustEngine">
<bean class="net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine">
<constructor-arg index="0">
@@ -301,7 +298,7 @@
</bean>
</property>
<property name="entityStatementSignatureValidationFilterStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.DefaultEntityStatementSignatureValidationFilterStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.DefaultEntityStatementSignatureValidationFilterStrategy">
<property name="trustEngine">
<bean class="net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine">
<constructor-arg index="0">
@@ -318,7 +315,7 @@
</bean>
</property>
<property name="fetchStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.tc.DefaultTrustChainFetchingStrategy"
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.trustchain.DefaultTrustChainFetchingStrategy"
p:criteriaToSubjectEntityIdStrategy-ref="shibboleth.oidfed.DefaultSubjectEntityIDCriteriaToIdentifierStrategy"
p:entityConfigurationCache-ref="shibboleth.oidfed.EntityConfigurationMetadataCache"
p:subordinateStatementCache-ref="shibboleth.oidfed.SubordinateEntityStatementMetadataCache"
@@ -349,30 +346,30 @@
p:maxCacheDuration="%{idp.oidfed.cache.resolveEntity.maxRefreshDelay:PT30M}"
p:metadataExpirationTimeStrategy-ref="DefaultResponseContainerExpirationTimeStrategy">
<property name="criteriaToIdentifierStrategy">
- <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remoteresolver.RemoteResolveEntityCacheIdentifierCriterion))?.getIdentifier()"/>
+ <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.resolver.RemoteResolveEntityCacheIdentifierCriterion))?.getIdentifier()"/>
</property>
<property name="identifierExtractionStrategy">
<bean parent="shibboleth.Functions.Expression" c:expression="#input?.getIdentifier()"/>
</property>
<property name="metadataFilterStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementMetadataFilterStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.DefaultEntityStatementMetadataFilterStrategy">
<property name="validationConditions">
<util:list value-type="java.util.function.BiPredicate">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementSignatureValidationCondition"
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.DefaultEntityStatementSignatureValidationCondition"
p:trustEngine-ref="shibboleth.oidfed.DefaultSubordinateStatementTrustEngine">
<property name="criteriaSetLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementValidationCriteriaSetLookupFunction"
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.DefaultEntityStatementValidationCriteriaSetLookupFunction"
p:entityConfigurationCache-ref="shibboleth.oidfed.EntityConfigurationMetadataCache"/>
</property>
</bean>
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementContentValidationCondition"
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.DefaultEntityStatementContentValidationCondition"
p:claimsValidator-ref="%{idp.oidfed.remoteResolver.claimsValidator:shibboleth.oidfed.DefaultResolveEntityResponseClaimsValidator}"/>
</util:list>
</property>
</bean>
</property>
<property name="fetchStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remoteresolver.DefaultResolveEntityTrustChainFetchingStrategy"
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.resolver.DefaultResolveEntityTrustChainFetchingStrategy"
p:httpClient="#{getObject('shibboleth.oidfed.HttpClient') ?: getObject('shibboleth.InternalHttpClient')}"
p:httpClientSecurityParameters="#{getObject('shibboleth.oidfed.NonBrowser.HttpClientSecurityParameters')}"
p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper">
@@ -454,7 +451,7 @@
<property name="parsingStrategy">
<bean class="net.shibboleth.oidc.metadata.cache.impl.DefaultJSONMapParsingStrategy"
c:mapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper"
- c:valueClass="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.LocalKeyContainer"/>
+ c:valueClass="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.LocalKeyContainer"/>
</property>
<property name="sourceMetadataExpiryStrategy">
<bean class="net.shibboleth.oidc.metadata.cache.impl.DefaultSourceMetadataExpirationTimeStrategy"
@@ -464,34 +461,34 @@
<bean id="shibboleth.oidfed.TrustMarkStatusMetadataCacheBuilderSpec"
class="net.shibboleth.oidc.metadata.cache.impl.DynamicMetadataCacheBuilderSpec"
- p:metadataExpirationTimeStrategy-ref="shibboleth.oidfed.DefaultEntityStatementExpirationTimeStrategy"
p:minCacheDuration="%{idp.oidfed.cache.trustMarkStatus.maxRefreshDelay:PT60S}"
- p:maxCacheDuration="%{idp.oidfed.cache.trustMarkStatus.maxRefreshDelay:PT30M}">
+ p:maxCacheDuration="%{idp.oidfed.cache.trustMarkStatus.maxRefreshDelay:PT30M}"
+ p:metadataExpirationTimeStrategy-ref="DefaultResponseContainerExpirationTimeStrategy">
<property name="identifierExtractionStrategy">
<bean parent="shibboleth.Functions.Expression" c:expression="#input?.getRequest().getTrustMark().serialize()"/>
</property>
<property name="criteriaToIdentifierStrategy">
- <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.tm.TrustMarkStatusIdentifierCriterion))?.getIdentifier()"/>
+ <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.trustmark.TrustMarkStatusIdentifierCriterion))?.getIdentifier()"/>
</property>
<property name="metadataFilterStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementMetadataFilterStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.DefaultEntityStatementMetadataFilterStrategy">
<property name="validationConditions">
<util:list value-type="java.util.function.BiPredicate">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementSignatureValidationCondition"
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.DefaultEntityStatementSignatureValidationCondition"
p:trustEngine-ref="shibboleth.oidfed.DefaultSubordinateStatementTrustEngine">
<property name="criteriaSetLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.tm.DefaultTrustMarkValidationCriteriaSetLookupFunction"
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.trustmark.DefaultTrustMarkValidationCriteriaSetLookupFunction"
p:trustChainCache-ref="shibboleth.oidfed.TrustChainMetadataCache"/>
</property>
</bean>
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementContentValidationCondition"
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.DefaultEntityStatementContentValidationCondition"
p:claimsValidator-ref="%{idp.oidfed.trustMarkStatus.claimsValidator:shibboleth.oidfed.DefaultTrustMarkStatusClaimsValidator}"/>
</util:list>
</property>
</bean>
</property>
<property name="fetchStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.tm.DefaultTrustMarkStatusFetchingStrategy"
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.trustmark.DefaultTrustMarkStatusFetchingStrategy"
p:httpClient="#{getObject('shibboleth.oidfed.HttpClient') ?: getObject('shibboleth.InternalHttpClient')}"
p:httpClientSecurityParameters="#{getObject('shibboleth.oidfed.NonBrowser.HttpClientSecurityParameters')}"
p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper">
@@ -549,27 +546,27 @@
<bean parent="shibboleth.Functions.Expression" c:expression="#input?.getIdentifier()"/>
</property>
<property name="criteriaToIdentifierStrategy">
- <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.tm.TrustMarkIdentifierCriterion))?.getIdentifier()"/>
+ <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.trustmark.TrustMarkIdentifierCriterion))?.getIdentifier()"/>
</property>
<property name="metadataFilterStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementMetadataFilterStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.DefaultEntityStatementMetadataFilterStrategy">
<property name="validationConditions">
<util:list value-type="java.util.function.BiPredicate">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementSignatureValidationCondition"
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.DefaultEntityStatementSignatureValidationCondition"
p:trustEngine-ref="shibboleth.oidfed.DefaultSubordinateStatementTrustEngine">
<property name="criteriaSetLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.tm.DefaultTrustMarkValidationCriteriaSetLookupFunction"
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.trustmark.DefaultTrustMarkValidationCriteriaSetLookupFunction"
p:trustChainCache-ref="shibboleth.oidfed.TrustChainMetadataCache"/>
</property>
</bean>
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementContentValidationCondition"
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.DefaultEntityStatementContentValidationCondition"
p:claimsValidator-ref="%{idp.oidfed.trustMark.claimsValidator:shibboleth.oidfed.DefaultTrustMarkClaimsValidator}"/>
</util:list>
</property>
</bean>
</property>
<property name="fetchStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.tm.DefaultTrustMarkFetchingStrategy"
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.trustmark.DefaultTrustMarkFetchingStrategy"
p:httpClient="#{getObject('shibboleth.oidfed.HttpClient') ?: getObject('shibboleth.InternalHttpClient')}"
p:httpClientSecurityParameters="#{getObject('shibboleth.oidfed.NonBrowser.HttpClientSecurityParameters')}"
p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper">
@@ -625,7 +622,7 @@
class="net.shibboleth.shared.spring.resource.PreferFileSystemResourceLoader"/>
<bean id="shibboleth.oidfed.DefaultLocalTrustAnchorsValidator"
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.DefaultLocalTrustAnchorsValidator"/>
+ class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.DefaultLocalTrustAnchorsValidator"/>
<bean id="shibboleth.oidfed.LocalTrustAnchorsDefaultIdentifierStrategy"
parent="shibboleth.Functions.Constant" c:target="#{getObject('shibboleth.oidfed.DefaultLocalTrustAnchorsFilename') ?: 'undefined'}" />
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/metadata-lookup-ext/oidfed/metadata-lookup-ext-oidfed-beans.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/metadata-lookup-ext/oidfed/metadata-lookup-ext-oidfed-beans.xml
index 370dc07..0d25b16 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/metadata-lookup-ext/oidfed/metadata-lookup-ext-oidfed-beans.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/metadata-lookup-ext/oidfed/metadata-lookup-ext-oidfed-beans.xml
@@ -38,8 +38,7 @@
p:arraysAsSpaceSeparatedList="%{idp.oidfed.policy.arraysAsSpaceSeparatedList:scope}"
p:metadataValidationCondition-ref="#{'%{idp.oidfed.MetadataValidationCondition:DefaultMetadataValidationCondition}'.trim()}">
<property name="metadataLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.DefaultCombinedMetadataFromTrustChainLookupStrategy"
- p:objectMapper-ref="shibboleth.oidc.JSONObjectMapper" />
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultCombinedMetadataFromTrustChainLookupStrategy" />
</property>
<property name="clientIDLookupStrategy">
<bean class="net.shibboleth.idp.plugin.oidc.op.profile.logic.DefaultMetadataLookupExtensionContextClientIDLookupFunction" />
@@ -56,8 +55,7 @@
<bean id="DefaultTrustChainMetadataPolicyMergingStrategy"
class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate.DefaultTrustChainMetadataPolicyMergingStrategy"
p:metadataPolicyMergingStrategy-ref="#{'%{idp.oidfed.authorize.MetadataPolicMergingyStrategy:MetadataPolicMergingyStrategy}'.trim()}"
- p:localMetadataPolicyStrategy-ref="#{'%{idp.oidfed.authorize.LocalMetadataPolicyStrategy:DefaultLocalMetadataPolicyStrategy}'.trim()}"
- p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper"/>
+ p:localMetadataPolicyStrategy-ref="#{'%{idp.oidfed.authorize.LocalMetadataPolicyStrategy:DefaultLocalMetadataPolicyStrategy}'.trim()}"/>
<bean id="MetadataPolicMergingyStrategy"
class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicyMergingStrategy"
@@ -111,15 +109,13 @@
p:trustEngine-ref="shibboleth.oidfed.DefaultEntityConfigurationTrustEngine"
p:delegationTrustEngine-ref="shibboleth.oidfed.DefaultDelegatedTrustMarkTrustEngine">
<property name="trustChainTrustMarksParsingStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.DefaultTrustChainTrustMarksParsingStrategy"
- p:objectMapper-ref="shibboleth.oidc.JSONObjectMapper" />
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultTrustChainTrustMarksParsingStrategy"/>
</property>
<property name="trustedTrustMarkIssuersLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.DefaultTrustChainTrustedTrustMarkIssuersLookupStrategy"
- p:objectMapper-ref="shibboleth.oidc.JSONObjectMapper" />
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultTrustChainTrustedTrustMarkIssuersLookupStrategy"/>
</property>
<property name="trustedTrustMarkOwnersLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.DefaultTrustChainTrustedTrustMarkOwnersLookupStrategy"/>
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultTrustChainTrustedTrustMarkOwnersLookupStrategy"/>
</property>
</bean>
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/entity-configuration/entity-configuration-beans.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/entity-configuration/entity-configuration-beans.xml
index 6cd7e13..5b21a3e 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/entity-configuration/entity-configuration-beans.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/entity-configuration/entity-configuration-beans.xml
@@ -33,13 +33,13 @@
<bean parent="shibboleth.Functions.Constant" c:target-ref="shibboleth.oidc.issuer" />
</property>
<property name="metadataExpirationTimeStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.DefaultNimbusResponseContainerExpirationTimeStrategy"/>
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.DefaultNimbusResponseContainerExpirationTimeStrategy"/>
</property>
<property name="metadataFilterStrategy">
<bean parent="shibboleth.BiFunctions.Expression" c:expression="#input1"/>
</property>
<property name="fetchStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.DefaultEntityConfigurationResponseFetchingStrategy" />
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.DefaultEntityConfigurationResponseFetchingStrategy" />
</property>
</bean>
@@ -54,7 +54,7 @@
p:metadataSkeletonLookupStrategy-ref="#{'%{idp.oidfed.configuration.EntityConfigurationMetadataSkeletonLookupStrategy:DefaultEntityConfigurationMetadataSkeletonLookupStrategy}'.trim()}"/>
<bean id="DefaultEntityConfigurationMetadataSkeletonLookupStrategy"
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.DefaultEntityConfigurationMetadataSkeletonLookupStrategy"
+ class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.DefaultEntityConfigurationMetadataSkeletonLookupStrategy"
p:metadataSkeletonCache-ref="shibboleth.oidfed.EntityConfigurationMetadataSkeletonMetadataCache"/>
<bean id="PopulateEntityStatementSignatureSigningParameters"
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/register/register-beans.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/register/register-beans.xml
index 142e58a..6c1e6fa 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/register/register-beans.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/register/register-beans.xml
@@ -45,11 +45,11 @@
p:metadataLookupStrategy-ref="DefaultCombinedMetadataFromTrustChainLookupStrategy"
p:metadataValidationCondition-ref="#{'%{idp.oidfed.MetadataValidationCondition:DefaultMetadataValidationCondition}'.trim()}">
<property name="providedTrustChainValidationStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.DefaultProvidedTrustChainValidationStrategy"
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultProvidedTrustChainValidationStrategy"
p:federationPolicyConstraints-ref="%{idp.oidfed.FederationPolicyConstraints:shibboleth.oidfed.DefaultFederationPolicyConstraints}"
p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper">
<property name="trustChainSignatureValidationFilterStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.tc.DefaultProvidedTrustChainSignatureValidationFilterStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultProvidedTrustChainSignatureValidationFilterStrategy">
<property name="trustEngine">
<bean class="net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine">
<constructor-arg index="0">
@@ -61,7 +61,7 @@
</bean>
</property>
<property name="entityStatementSignatureValidationFilterStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.DefaultEntityStatementSignatureValidationFilterStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.DefaultEntityStatementSignatureValidationFilterStrategy">
<property name="trustEngine">
<bean class="net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine">
<constructor-arg index="0">
@@ -94,7 +94,7 @@
<bean parent="shibboleth.BiConditions.Expression"
c:expression="#custom.apply(#input2, null) != null">
<property name="customObject">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.DefaultEntityStatementSignatureValidationFilterStrategy"
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.DefaultEntityStatementSignatureValidationFilterStrategy"
p:trustEngine-ref="shibboleth.oidfed.DefaultEntityConfigurationTrustEngine"/>
</property>
</bean>
@@ -106,8 +106,7 @@
class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate.DefaultMetadataValidationCondition" />
<bean id="DefaultCombinedMetadataFromTrustChainLookupStrategy"
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.DefaultCombinedMetadataFromTrustChainLookupStrategy"
- p:objectMapper-ref="shibboleth.oidc.JSONObjectMapper" />
+ class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultCombinedMetadataFromTrustChainLookupStrategy"/>
<bean id="CallResolveEntityApi" class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.CallResolveEntityApi"
scope="prototype"
@@ -146,7 +145,7 @@
<bean parent="shibboleth.Functions.Expression" c:expression="#input?.getEntityId()"/>
</property>
<property name="fetchStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.tc.DefaultTrustChainFetchingStrategy"
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.trustchain.DefaultTrustChainFetchingStrategy"
p:criteriaToSubjectEntityIdStrategy-ref="shibboleth.oidfed.DefaultSubjectEntityIDCriteriaToIdentifierStrategy"
p:entityConfigurationCache-ref="shibboleth.oidfed.EntityConfigurationMetadataCache"
p:subordinateStatementCache-ref="shibboleth.oidfed.SubordinateEntityStatementMetadataCache"
@@ -180,8 +179,7 @@
<bean id="DefaultTrustChainMetadataPolicyMergingStrategy"
class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate.DefaultTrustChainMetadataPolicyMergingStrategy"
p:metadataPolicyMergingStrategy-ref="#{'%{idp.oidfed.register.MetadataPolicMergingyStrategy:MetadataPolicMergingyStrategy}'.trim()}"
- p:localMetadataPolicyStrategy-ref="#{'%{idp.oidfed.register.LocalMetadataPolicyStrategy:DefaultLocalMetadataPolicyStrategy}'.trim()}"
- p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper"/>
+ p:localMetadataPolicyStrategy-ref="#{'%{idp.oidfed.register.LocalMetadataPolicyStrategy:DefaultLocalMetadataPolicyStrategy}'.trim()}"/>
<bean id="MetadataPolicMergingyStrategy"
class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicyMergingStrategy"
@@ -219,15 +217,13 @@
p:trustEngine-ref="shibboleth.oidfed.DefaultEntityConfigurationTrustEngine"
p:delegationTrustEngine-ref="shibboleth.oidfed.DefaultDelegatedTrustMarkTrustEngine">
<property name="trustChainTrustMarksParsingStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.DefaultTrustChainTrustMarksParsingStrategy"
- p:objectMapper-ref="shibboleth.oidc.JSONObjectMapper" />
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultTrustChainTrustMarksParsingStrategy"/>
</property>
<property name="trustedTrustMarkIssuersLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.DefaultTrustChainTrustedTrustMarkIssuersLookupStrategy"
- p:objectMapper-ref="shibboleth.oidc.JSONObjectMapper" />
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultTrustChainTrustedTrustMarkIssuersLookupStrategy"/>
</property>
<property name="trustedTrustMarkOwnersLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.DefaultTrustChainTrustedTrustMarkOwnersLookupStrategy" />
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultTrustChainTrustedTrustMarkOwnersLookupStrategy"/>
</property>
<property name="activationCondition">
<bean parent="shibboleth.Conditions.Expression"
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/resolve-entity/resolve-entity-beans.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/resolve-entity/resolve-entity-beans.xml
index 0bea4da..4fbed93 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/resolve-entity/resolve-entity-beans.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/resolve-entity/resolve-entity-beans.xml
@@ -48,19 +48,19 @@
p:minCacheDuration="%{idp.oidfed.resolve-entity.maxRefreshDelay:PT1S}"
p:maxCacheDuration="%{idp.oidfed.resolve-entity.maxRefreshDelay:PT30S}">
<property name="criteriaToIdentifierStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.DefaultResolveEntityRequestCriteriaToIdentifierStrategy" />
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.DefaultResolveEntityRequestCriteriaToIdentifierStrategy" />
</property>
<property name="identifierExtractionStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.DefaultResolveEntityResponseIdentifierExtractionStrategy" />
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.DefaultResolveEntityResponseIdentifierExtractionStrategy" />
</property>
<property name="metadataExpirationTimeStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.DefaultNimbusResponseContainerExpirationTimeStrategy"/>
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.DefaultNimbusResponseContainerExpirationTimeStrategy"/>
</property>
<property name="metadataFilterStrategy">
<bean parent="shibboleth.BiFunctions.Expression" c:expression="#input1"/>
</property>
<property name="fetchStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.DefaultResolveEntityResponseFetchingStrategy" />
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.DefaultResolveEntityResponseFetchingStrategy" />
</property>
</bean>
@@ -83,8 +83,7 @@
p:arraysAsSpaceSeparatedList="%{idp.oidfed.policy.arraysAsSpaceSeparatedList:scope}"
p:metadataValidationCondition-ref="#{'%{idp.oidfed.MetadataValidationCondition:DefaultMetadataValidationCondition}'.trim()}">
<property name="metadataLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.DefaultCombinedMetadataFromTrustChainLookupStrategy"
- p:objectMapper-ref="shibboleth.oidc.JSONObjectMapper" />
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultCombinedMetadataFromTrustChainLookupStrategy"/>
</property>
</bean>
@@ -98,8 +97,7 @@
<bean id="DefaultTrustChainMetadataPolicyMergingStrategy"
class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate.DefaultTrustChainMetadataPolicyMergingStrategy"
p:metadataPolicyMergingStrategy-ref="#{'%{idp.oidfed.resolve-entity.MetadataPolicMergingyStrategy:MetadataPolicMergingyStrategy}'.trim()}"
- p:localMetadataPolicyStrategy-ref="#{'%{idp.oidfed.resolve-entity.LocalMetadataPolicyStrategy:DefaultLocalMetadataPolicyStrategy}'.trim()}"
- p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper"/>
+ p:localMetadataPolicyStrategy-ref="#{'%{idp.oidfed.resolve-entity.LocalMetadataPolicyStrategy:DefaultLocalMetadataPolicyStrategy}'.trim()}"/>
<bean id="MetadataPolicMergingyStrategy"
class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicyMergingStrategy"
@@ -132,15 +130,13 @@
p:trustEngine-ref="shibboleth.oidfed.DefaultEntityConfigurationTrustEngine"
p:delegationTrustEngine-ref="shibboleth.oidfed.DefaultDelegatedTrustMarkTrustEngine">
<property name="trustChainTrustMarksParsingStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.DefaultTrustChainTrustMarksParsingStrategy"
- p:objectMapper-ref="shibboleth.oidc.JSONObjectMapper" />
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultTrustChainTrustMarksParsingStrategy"/>
</property>
<property name="trustedTrustMarkIssuersLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.DefaultTrustChainTrustedTrustMarkIssuersLookupStrategy"
- p:objectMapper-ref="shibboleth.oidc.JSONObjectMapper" />
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultTrustChainTrustedTrustMarkIssuersLookupStrategy"/>
</property>
<property name="trustedTrustMarkOwnersLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.DefaultTrustChainTrustedTrustMarkOwnersLookupStrategy" />
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultTrustChainTrustedTrustMarkOwnersLookupStrategy"/>
</property>
</bean>
diff --git a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/EntityConfigurationFlowTest.java b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/EntityConfigurationFlowTest.java
index 867a617..a4278d2 100644
--- a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/EntityConfigurationFlowTest.java
+++ b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/EntityConfigurationFlowTest.java
@@ -42,7 +42,7 @@ import com.nimbusds.openid.connect.sdk.federation.registration.ClientRegistratio
import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
import net.shibboleth.idp.plugin.oidc.op.oidfed.TrustChainTestUtil;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.tm.DefaultTrustMarkFetchingStrategy;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.trustmark.DefaultTrustMarkFetchingStrategy;
import net.shibboleth.shared.collection.CollectionSupport;
/**
diff --git a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/EntityConfigurationMetadataCacheTest.java b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/EntityConfigurationMetadataCacheTest.java
index 42588d3..3f1c41b 100644
--- a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/EntityConfigurationMetadataCacheTest.java
+++ b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/EntityConfigurationMetadataCacheTest.java
@@ -32,9 +32,9 @@ import com.nimbusds.jose.jwk.JWKSet;
import com.nimbusds.jwt.JWTClaimsSet;
import net.shibboleth.idp.plugin.oidc.op.oidfed.TrustChainTestUtil;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.ResponseContainerExpirationCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SubjectEntityIDCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.RemoteEntityConfigurationContainer;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.ResponseContainerExpirationCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityIDCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.RemoteEntityConfigurationContainer;
import net.shibboleth.idp.plugin.oidc.op.profile.flow.oidfed.AbstractFederationFlowTest;
import net.shibboleth.idp.plugin.oidc.op.profile.flow.oidfed.EntityConfigurationFlowTest;
import net.shibboleth.oidc.metadata.cache.MetadataCache;
diff --git a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/SubordinateStatementMetadataCacheTest.java b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/SubordinateStatementMetadataCacheTest.java
index d5b2ab9..8fa01f6 100644
--- a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/SubordinateStatementMetadataCacheTest.java
+++ b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/SubordinateStatementMetadataCacheTest.java
@@ -32,10 +32,10 @@ import com.nimbusds.jose.jwk.JWKSet;
import com.nimbusds.jwt.JWTClaimsSet;
import net.shibboleth.idp.plugin.oidc.op.oidfed.TrustChainTestUtil;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.IssuerEntityIDCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.ResponseContainerExpirationCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SubjectEntityIDCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.RemoteSubordinateStatementContainer;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.IssuerEntityIDCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.ResponseContainerExpirationCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityIDCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.RemoteSubordinateStatementContainer;
import net.shibboleth.idp.plugin.oidc.op.profile.flow.oidfed.AbstractFederationFlowTest;
import net.shibboleth.idp.plugin.oidc.op.profile.flow.oidfed.EntityConfigurationFlowTest;
import net.shibboleth.oidc.metadata.cache.MetadataCache;
diff --git a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/TrustChainMetadataCacheTest.java b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/TrustChainMetadataCacheTest.java
index 803ac08..af56106 100644
--- a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/TrustChainMetadataCacheTest.java
+++ b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/TrustChainMetadataCacheTest.java
@@ -32,10 +32,10 @@ import com.nimbusds.jose.jwk.JWKSet;
import com.nimbusds.jwt.JWTClaimsSet;
import net.shibboleth.idp.plugin.oidc.op.oidfed.TrustChainTestUtil;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.IssuerEntityIDCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.ResponseContainerExpirationCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SubjectEntityIDCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.RemoteTrustChainsContainer;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.IssuerEntityIDCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.ResponseContainerExpirationCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityIDCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.remote.RemoteTrustChainsContainer;
import net.shibboleth.idp.plugin.oidc.op.profile.flow.oidfed.AbstractFederationFlowTest;
import net.shibboleth.idp.plugin.oidc.op.profile.flow.oidfed.EntityConfigurationFlowTest;
import net.shibboleth.oidc.metadata.cache.MetadataCache;
diff --git a/pom.xml b/pom.xml
index 386a9cd..b84cf69 100644
--- a/pom.xml
+++ b/pom.xml
@@ -210,7 +210,7 @@
<Implementation-Title>${project.artifactId}</Implementation-Title>
<Implementation-Version>${project.version}</Implementation-Version>
<Implementation-Vendor>shibboleth.net</Implementation-Vendor>
- <Sealed>false</Sealed> <!-- TODO: temporarily set to false during refactoring-->
+ <Sealed>true</Sealed>
</manifestEntries>
</archive>
</configuration>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list