[java-idp-plugin-oidc-config] branch main updated: JOIDCCONF-7 - Add OIDC.SSO.MDDriven profile bean

Henri Mikkonen henri.mikkonen at iki.fi
Thu Jun 5 13:16:34 UTC 2025


This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-plugin-oidc-config.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-config.git;a=commit;h=0cdb5f04fb77e1c1bef1b85f7511639e6685d6b6

The following commit(s) were added to refs/heads/main by this push:
     new 0cdb5f0  JOIDCCONF-7 - Add OIDC.SSO.MDDriven profile bean
0cdb5f0 is described below

commit 0cdb5f04fb77e1c1bef1b85f7511639e6685d6b6
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Thu Jun 5 16:14:24 2025 +0300

    JOIDCCONF-7 - Add OIDC.SSO.MDDriven profile bean
    
    https://shibboleth.atlassian.net/browse/JOIDCCONF-7
    
    - Add OIDC.SSO.MDDriven and the abstract profiles inherited by it
      - AbstractMDDrivenOIDCProfile
        - moved from OP intact
      - AbstractMDDrivenOAuthClientAuthenticatableProfile
        - modified forceAuthnPredicate to default to ProxyAwareForceAuthnPredicate
        - modified defaultAuthenticationMethodsLookupStrategy to default to ProxyAwareDefaultOIDCAuthenticationContextClassRequestLookupFunction
      - AbstractMDDrivenOIDCFlowAwareProfile
        - intact
      - AbstractMDDrivenOIDCSSOProfile
        - add new useTargetedEndpointAsJWTAudiencePredicate
        - add previously missing refreshTokenType
        - add RP-specific tokenEndpointAuthMethodLookupStrategy, clientIdLookupStrategy, clientCredentialLookupStrategy
      - OIDC.SSO.MDDriven
        - add RP-specific httpRequestMethodLookupStrategy, retrieveUserInfoEndpointClaimsPredicate, redirectUriOverrideLookupStrategy, responseModeLookupStrategy, tlsServerValidationSufficientPredicate, userInfoHttpRequestMethodLookupStrategy, scopesLookupStrategy, authenticationContextClassReferenceTranslationStrategyLookupStrategy, authenticationMethodsReferencesTranslationStrategyLookupStrategy
---
 .../idp/service/relying-party/postconfig.xml       | 432 +++++++++++++++++++++
 1 file changed, 432 insertions(+)

diff --git a/oidc-config-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/oidc-config-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index 1a53c70..3154969 100644
--- a/oidc-config-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/oidc-config-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -105,7 +105,439 @@
             </bean>
         </property>
     </bean>
+
+    <bean id="AbstractMDDrivenOIDCProfile" parent="AbstractMDDrivenProfile" abstract="true">
+        <property name="securityConfigurationLookupStrategy">
+            <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="securityConfiguration"
+                p:propertyType="#{T(org.opensaml.security.config.SecurityConfiguration)}"
+                p:defaultValue-ref="%{idp.security.oidc.config:shibboleth.oidc.DefaultSecurityConfiguration}" />
+        </property>
+    </bean>
+
+    <bean id="AbstractMDDrivenOAuthClientAuthenticatableProfile" parent="AbstractMDDrivenOIDCProfile" abstract="true">
+        <property name="claimsValidatorLookupStrategy">
+            <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="claimsValidator"
+                p:propertyType="#{T(net.shibboleth.oidc.jwt.claims.ClaimsValidator)}"
+                p:defaultValue="#{getObject('DefaultJWTClaimsValidator')}" />
+        </property>
+        <property name="forceAuthnPredicate">
+            <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+                <constructor-arg>
+                    <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="forceAuthn" />
+                </constructor-arg>
+                <constructor-arg>
+                    <bean class="net.shibboleth.idp.saml.profile.config.logic.ProxyAwareForceAuthnPredicate" />
+                </constructor-arg>
+            </bean>
+        </property>
+        <property name="proxyCountLookupStrategy">
+            <bean parent="shibboleth.MDDrivenIntProperty" p:propertyName="proxyCount" />
+        </property>
+        <property name="authenticationFlowsLookupStrategy">
+            <bean parent="shibboleth.MDDrivenSetProperty" p:propertyName="authenticationFlows" />
+        </property>
+        <property name="postAuthenticationFlowsLookupStrategy">
+            <bean parent="shibboleth.MDDrivenListProperty" p:propertyName="postAuthenticationFlows" />
+        </property>
+        <property name="defaultAuthenticationMethodsLookupStrategy">
+            <bean parent="shibboleth.MDDrivenListProperty" p:propertyName="defaultAuthenticationMethods"
+                p:propertyType="#{T(net.shibboleth.oidc.authn.principal.AuthenticationContextClassReferencePrincipal)}">
+                <property name="defaultValueStrategy">
+                    <bean class="net.shibboleth.oidc.profile.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassRequestLookupFunction"
+                        p:mappings="#{getObject('shibboleth.oidc.PrincipalProxyRequestMappings')}" />
+                </property>
+            </bean>
+        </property>
+        <property name="messageHandlerLookupStrategy">
+            <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="messageHandler"
+                p:propertyType="#{T(java.util.function.Function)}" />
+        </property>
+        <property name="requireDpopProofPredicate">
+            <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+                <constructor-arg>
+                    <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="requireDpopProof" />
+                </constructor-arg>
+                <constructor-arg value="false" />
+            </bean>
+        </property>
+        <property name="dpopProofSignatureValidationConfigurationLookupStrategy">
+            <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="dpopProofSignatureValidationConfiguration"
+                p:propertyType="#{T(net.shibboleth.oidc.security.jose.SignatureValidationConfiguration)}"
+                p:defaultValue="#{getObject('DPoPSignatureValidationConfiguration')}" />
+        </property>
+        <property name="dpopProofNonceGeneratorLookupStrategy">
+            <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="dpopProofNonceGenerator"
+                p:propertyType="#{T(java.util.function.Function)}"
+                p:defaultValue="#{getObject('DefaultOAuth2DPoPNonceGenerator')}" />
+        </property>
+    </bean>
+
+    <bean id="AbstractMDDrivenOIDCFlowAwareProfile" parent="AbstractMDDrivenOAuthClientAuthenticatableProfile" abstract="true">
+        <property name="authorizationCodeFlowEnabledPredicate">
+            <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+                <constructor-arg>
+                    <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="authorizationCodeFlowEnabled" />
+                </constructor-arg>
+                <constructor-arg value="true" />
+            </bean>
+        </property>
+        <property name="implicitFlowEnabledPredicate">
+            <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+                <constructor-arg>
+                    <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="implicitFlowEnabled" />
+                </constructor-arg>
+                <constructor-arg value="true" />
+            </bean>
+        </property>
+        <property name="hybridFlowEnabledPredicate">
+            <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+                <constructor-arg>
+                    <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="hybridFlowEnabled" />
+                </constructor-arg>
+                <constructor-arg value="true" />
+            </bean>
+        </property>
+        <property name="refreshTokensEnabledPredicate">
+            <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+                <constructor-arg>
+                    <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="refreshTokensEnabled" />
+                </constructor-arg>
+                <constructor-arg value="true" />
+            </bean>
+        </property>
+    </bean>
     
+    <bean id="AbstractMDDrivenOIDCSSOProfile" parent="AbstractMDDrivenOIDCFlowAwareProfile" abstract="true">
+        <property name="issuerLookupStrategy">
+            <bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="issuer"
+            p:defaultValue="#{getObject('shibboleth.oidc.issuer')}" />
+        </property>
+        <property name="tokenEndpointAuthMethodsLookupStrategy">
+            <bean parent="shibboleth.MDDrivenSetProperty" p:propertyName="tokenEndpointAuthMethods">
+                <property name="defaultValue">
+                    <bean parent="shibboleth.CommaDelimStringArray">
+                        <constructor-arg type="java.lang.String"
+                            value="%{idp.oidc.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}" />
+                    </bean>
+                </property>
+            </bean>
+        </property>
+        <property name="resolveAttributesPredicate">
+            <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+                <constructor-arg>
+                    <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="resolveAttributes" />
+                </constructor-arg>
+                <constructor-arg value="true" />
+            </bean>
+        </property>
+        <property name="encryptionOptionalPredicate">
+            <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+                <constructor-arg>
+                    <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="encryptionOptional" />
+                </constructor-arg>
+                <constructor-arg value="%{idp.oidc.encryptionOptional:true}" />
+            </bean>
+        </property>
+        <property name="forcePKCEPredicate">
+            <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+                <constructor-arg>
+                    <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="forcePKCE" />
+                </constructor-arg>
+                <constructor-arg value="%{idp.oidc.forcePKCE:false}" />
+            </bean>
+        </property>
+        <property name="allowPKCEPlainPredicate">
+            <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+                <constructor-arg>
+                    <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="allowPKCEPlain" />
+                </constructor-arg>
+                <constructor-arg value="%{idp.oidc.allowPKCEPlain:false}" />
+            </bean>
+        </property>
+        <property name="iDTokenLifetimeLookupStrategy">
+            <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="IDTokenLifetime"
+                p:defaultValue="%{idp.oidc.idToken.defaultLifetime:PT1H}" />
+        </property>
+        <property name="accessTokenTypeLookupStrategy">
+            <bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="accessTokenType"
+                p:defaultValue="%{idp.oidc.accessToken.type:%{idp.oauth2.accessToken.type:}}" />
+        </property>
+        <property name="accessTokenLifetimeLookupStrategy">
+            <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="accessTokenLifetime"
+                p:defaultValue="%{idp.oidc.accessToken.defaultLifetime:PT10M}" />
+        </property>
+        <property name="refreshTokenTypeLookupStrategy">
+            <bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="refreshTokenType"
+                p:defaultValue="%{idp.oidc.accessToken.type:%{idp.oauth2.refreshTokenType.type:}}" />
+        </property>
+        <property name="additionalAudiencesForIdTokenLookupStrategy">
+            <bean parent="shibboleth.MDDrivenSetProperty" p:propertyName="tokenAudiences" />
+        </property>
+        <property name="alwaysIncludedAttributesLookupStrategy">
+            <bean parent="shibboleth.MDDrivenSetProperty" p:propertyName="alwaysIncludedAttributes">
+                <property name="defaultValue">
+                    <bean parent="shibboleth.CommaDelimStringArray">
+                        <constructor-arg type="java.lang.String" value="%{idp.oidc.alwaysIncludedAttributes:}" />
+                    </bean>
+                </property>
+            </bean>
+        </property>
+        <property name="tokenEndpointAuthMethodLookupStrategy">
+            <bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="tokenEndpointAuthMethod"
+                p:defaultValue="%{idp.authn.oidc.rp.client.authenticationMethod:client_secret_basic}" />
+        </property>
+        <property name="useTargetedEndpointAsJWTAudiencePredicate">
+            <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+                <constructor-arg>
+                    <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="useTargetedEndpointAsJWTAudience" />
+                </constructor-arg>
+                <constructor-arg value="%{idp.oauth2.jwtAuth.targetedEndpointAsJWTAudience:false}" />
+            </bean>
+        </property>
+        <property name="clientIdLookupStrategy">
+            <bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="clientId"
+                p:defaultValue="#{%{idp.authn.oidc.rp.provider.discoveryRequired:false} == true ? null : '%{idp.authn.oidc.rp.client.clientId:}'}" />
+        </property>
+        <property name="clientCredentialLookupStrategy">
+            <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="clientCredential"
+                p:propertyType="#{T(java.util.function.Function)}"
+                p:defaultValue="#{%{idp.authn.oidc.rp.provider.discoveryRequired:false} == true ? {null} : getObject('shibboleth.authn.oidc.rp.DefaultCredential')}" />
+        </property>
+        <property name="iDTokenManipulationStrategyLookupStrategy">
+            <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="IDTokenManipulationStrategy"
+                p:propertyType="#{T(java.util.function.BiFunction)}" />
+        </property>
+        <property name="accessTokenClaimsSetManipulationStrategyLookupStrategy">
+            <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="accessTokenClaimsSetManipulationStrategy"
+                p:propertyType="#{T(java.util.function.BiFunction)}" />
+        </property>
+        <property name="unregisteredClientPolicyLookupStrategy">
+            <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="unregisteredClientPolicy"
+                p:propertyType="#{T(java.util.function.Function)}"
+                p:defaultValue="#{getObject('shibboleth.oidc.DefaultUnregisteredClientPolicy')}" />
+        </property>
+        <property name="dpopProofClaimsValidatorLookupStrategy">
+            <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="dpopProofClaimsValidator"
+                p:propertyType="#{T(net.shibboleth.oidc.jwt.claims.ClaimsValidator)}"
+                p:defaultValue="#{getObject('DefaultDPoPProofClaimsValidator')}" />
+        </property>
+        <property name="dpopProofSignatureValidationConfigurationLookupStrategy">
+            <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="dpopProofSignatureValidationConfiguration"
+                p:propertyType="#{T(net.shibboleth.oidc.security.jose.SignatureValidationConfiguration)}"
+                p:defaultValue="#{getObject('DPoPSignatureValidationConfiguration')}" />
+        </property>
+        <property name="dpopProofNonceGeneratorLookupStrategy">
+            <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="dpopProofNonceGenerator"
+                p:propertyType="#{T(java.util.function.Function)}"
+                p:defaultValue="#{getObject('DefaultOAuth2DPoPNonceGenerator')}" />
+        </property>
+        <property name="strictScopeValidationPredicate">
+            <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+                <constructor-arg>
+                    <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="strictScopeValidation" />
+                </constructor-arg>
+                <constructor-arg value="%{idp.oidc.strictScopeValidation:false}" />
+            </bean>
+        </property>
+        <property name="customRedirectUriValidationStrategyLookupStrategy">
+            <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="customRedirectUriValidationStrategy"
+                p:propertyType="#{T(java.util.function.BiPredicate)}" />
+        </property>
+    </bean>
+
+    <bean id="OIDC.SSO.MDDriven" parent="AbstractMDDrivenOIDCSSOProfile" lazy-init="true"
+            class="net.shibboleth.oidc.profile.config.impl.DefaultOIDCAuthorizationConfiguration">
+        <property name="acrRequestAlwaysEssentialPredicate">
+            <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+                <constructor-arg>
+                    <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="acrRequestAlwaysEssential" />
+                </constructor-arg>
+                <constructor-arg value="false" />
+            </bean>
+        </property>
+        <property name="encodeConsentInTokensPredicate">
+            <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+                <constructor-arg>
+                    <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="encodeConsentInTokens" />
+                </constructor-arg>
+                <constructor-arg value="%{idp.oidc.encodeConsentInTokens:false}" />
+            </bean>
+        </property>
+        <property name="authorizeCodeLifetimeLookupStrategy">
+            <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="authorizeCodeLifetime"
+                p:defaultValue="%{idp.oidc.authorizeCode.defaultLifetime:PT5M}" />
+        </property>
+        <property name="encodedAttributesLookupStrategy">
+            <bean parent="shibboleth.MDDrivenSetProperty" p:propertyName="encodedAttributes">
+                <property name="defaultValue">
+                    <bean parent="shibboleth.CommaDelimStringArray">
+                        <constructor-arg type="java.lang.String"
+                            value="%{idp.oidc.encodedAttributes:%{idp.oidc.embeddedAttributes:}}" />
+                    </bean>
+                </property>
+            </bean>
+        </property>
+        <property name="deniedUserInfoAttributesLookupStrategy">
+            <bean parent="shibboleth.MDDrivenSetProperty" p:propertyName="deniedUserInfoAttributes">
+                <property name="defaultValue">
+                    <bean parent="shibboleth.CommaDelimStringArray">
+                        <constructor-arg type="java.lang.String" value="%{idp.oidc.deniedUserInfoAttributes:}" />
+                    </bean>
+                </property>
+            </bean>
+        </property>
+        <property name="httpRequestMethodLookupStrategy">
+            <bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="httpRequestMethod"
+                p:defaultValue="%{idp.authn.oidc.rp.httpRequestMethod:GET}" />
+        </property>
+        <property name="retrieveUserInfoEndpointClaimsPredicate">
+            <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+                <constructor-arg>
+                    <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="retrieveUserInfoEndpointClaims" />
+                </constructor-arg>
+                <constructor-arg value="%{idp.authn.oidc.rp.client.userinfo.enabled:true}" />
+            </bean>
+        </property>
+        <property name="redirectUriOverrideLookupStrategy">
+            <bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="redirectUriOverride"
+                p:defaultValue="{idp.authn.oidc.rp.client.redirectURI:#{null}}" />
+        </property>
+        <property name="refreshTokenTimeoutLookupStrategy">
+            <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="refreshTokenTimeout"
+                p:defaultValue="%{idp.oidc.refreshToken.defaultTimeout:%{idp.oidc.refreshToken.defaultLifetime:PT2H}}" />
+        </property>
+        <property name="refreshTokenChainLifetimeLookupStrategy">
+            <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="refreshTokenChainLifetime"
+                p:defaultValue="%{idp.oidc.refreshToken.defaultChainLifetime:PT2H}" />
+        </property>
+        <property name="includeIssuerInResponsePredicate">
+            <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+                <constructor-arg>
+                    <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="includeIssuerInResponse" />
+                </constructor-arg>
+                <constructor-arg value="false" />
+            </bean>
+        </property>
+        <property name="authorizationCodeClaimsSetManipulationStrategyLookupStrategy">
+            <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="authorizationCodeClaimsSetManipulationStrategy"
+                p:propertyType="#{T(java.util.function.BiFunction)}" />
+        </property>
+        <property name="securityConfigurationLookupStrategy">
+            <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="securityConfiguration"
+                p:propertyType="#{T(org.opensaml.security.config.SecurityConfiguration)}"
+                p:defaultValue-ref="%{idp.security.oidc.authorize.config:shibboleth.oidc.DefaultSecurityConfiguration}" />
+        </property>
+        <property name="encryptRequestObjectPredicate">
+            <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+                <constructor-arg>
+                    <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="encryptRequestObject" />
+                </constructor-arg>
+                <constructor-arg value="%{idp.oidc.requestobject.encrypted:false}" />
+            </bean>
+        </property>
+        <property name="signRequestObjectPredicate">
+            <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+                <constructor-arg>
+                    <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="signRequestObject" />
+                </constructor-arg>
+                <constructor-arg value="%{idp.oidc.requestobject.signed:true}" />
+            </bean>
+        </property>
+        <property name="useRequestObjectPredicate">
+            <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+                <constructor-arg>
+                    <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="useRequestObject" />
+                </constructor-arg>
+                <constructor-arg value="%{idp.oidc.requestobject.used:false}" />
+            </bean>
+        </property>
+        <property name="responseModeLookupStrategy">
+            <bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="responseMode"
+                p:defaultValue="%{idp.authn.oidc.rp.client.responseMode:#{null}}" />
+        </property>
+        <property name="tlsServerValidationSufficientPredicate">
+            <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+                <constructor-arg>
+                    <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="tlsServerValidationSufficient" />
+                </constructor-arg>
+                <constructor-arg value="%{idp.authn.oidc.rp.client.idtoken.tlsServerValidationOnly:false}" />
+            </bean>
+        </property>
+        <property name="userInfoHttpRequestMethodLookupStrategy">
+            <bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="userInfoHttpRequestMethod"
+                p:defaultValue="%{idp.authn.oidc.rp.client.userinfo.httpRequestMethod:GET}" />
+        </property>
+        <property name="scopesLookupStrategy">
+            <bean parent="shibboleth.MDDrivenSetProperty" p:propertyName="scopes">
+                <property name="defaultValue">
+                    <bean parent="shibboleth.CommaDelimStringArray">
+                        <constructor-arg type="java.lang.String"
+                            value="{idp.authn.oidc.rp.client.scopes:#{null}}" />
+                    </bean>
+                </property>
+            </bean>
+        </property>
+        <property name="responseModesLookupStrategy">
+            <bean parent="shibboleth.MDDrivenSetProperty" p:propertyName="responseModes">
+                <property name="defaultValue">
+                    <bean parent="shibboleth.CommaDelimStringArray">
+                        <constructor-arg type="java.lang.String"
+                            value="%{idp.oauth2.responseModes:}" />
+                    </bean>
+                </property>
+            </bean>
+        </property>
+        <property name="requireAuthenticationRequestPredicateLookupStrategy">
+            <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="requireAuthenticationRequestPredicate"
+                p:propertyType="#{T(java.util.function.Predicate)}"
+                p:defaultValue-ref="%{idp.oauth2.requireAuthenticationRequestPredicate:shibboleth.Conditions.TRUE}"/>
+        </property>
+        <property name="requirePushedAuthorizationRequestPredicate">
+            <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+                <constructor-arg>
+                    <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="requirePushedAuthorizationRequest" />
+                </constructor-arg>
+                <constructor-arg value="false" />
+            </bean>
+        </property>
+        <property name="requireDpopJktPredicate">
+            <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+                <constructor-arg>
+                    <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="requireDpopJkt" />
+                </constructor-arg>
+                <constructor-arg value="false" />
+            </bean>
+        </property>
+        <property name="authenticationContextClassReferenceTranslationStrategyLookupStrategy">
+            <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="authenticationContextClassReferenceTranslationStrategy"
+                p:propertyType="#{T(java.util.function.Function)}">
+                <property name="defaultValue">
+                    <bean
+                        class="net.shibboleth.oidc.profile.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction$LookupFunctionWrapper">
+                        <constructor-arg>
+                            <bean class="net.shibboleth.oidc.profile.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction"
+                                c:mappings="#{getObject('shibboleth.oidc.PrincipalProxyResponseMappings')}"/>
+                        </constructor-arg>
+                    </bean>
+                </property>
+            </bean>
+        </property>
+        <property name="authenticationMethodsReferencesTranslationStrategyLookupStrategy">
+            <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="authenticationMethodsReferencesTranslationStrategy"
+                p:propertyType="#{T(java.util.function.Function)}">
+                <property name="defaultValue">
+                    <bean
+                        class="net.shibboleth.oidc.profile.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction$LookupFunctionWrapper">
+                        <constructor-arg>
+                            <bean class="net.shibboleth.oidc.profile.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction"
+                                c:mappings="#{getObject('shibboleth.oidc.PrincipalProxyResponseMappings')}"/>
+                        </constructor-arg>
+                    </bean>
+                </property>
+            </bean>
+        </property>
+    </bean>
+
     <!-- Keyset profile -->
     <bean id="OIDC.Keyset" parent="AbstractOIDCProfile" lazy-init="true"
         class="net.shibboleth.oidc.profile.config.impl.DefaultOIDCPublishKeySetConfiguration"

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the commits mailing list