[java-idp-plugin-oidc-config] branch main updated: JOIDCCONF-7 - Add OIDC.SSO.MDDriven profile bean
Henri Mikkonen
henri.mikkonen at iki.fi
Thu Jun 5 13:16:34 UTC 2025
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-plugin-oidc-config.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-config.git;a=commit;h=0cdb5f04fb77e1c1bef1b85f7511639e6685d6b6
The following commit(s) were added to refs/heads/main by this push:
new 0cdb5f0 JOIDCCONF-7 - Add OIDC.SSO.MDDriven profile bean
0cdb5f0 is described below
commit 0cdb5f04fb77e1c1bef1b85f7511639e6685d6b6
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Thu Jun 5 16:14:24 2025 +0300
JOIDCCONF-7 - Add OIDC.SSO.MDDriven profile bean
https://shibboleth.atlassian.net/browse/JOIDCCONF-7
- Add OIDC.SSO.MDDriven and the abstract profiles inherited by it
- AbstractMDDrivenOIDCProfile
- moved from OP intact
- AbstractMDDrivenOAuthClientAuthenticatableProfile
- modified forceAuthnPredicate to default to ProxyAwareForceAuthnPredicate
- modified defaultAuthenticationMethodsLookupStrategy to default to ProxyAwareDefaultOIDCAuthenticationContextClassRequestLookupFunction
- AbstractMDDrivenOIDCFlowAwareProfile
- intact
- AbstractMDDrivenOIDCSSOProfile
- add new useTargetedEndpointAsJWTAudiencePredicate
- add previously missing refreshTokenType
- add RP-specific tokenEndpointAuthMethodLookupStrategy, clientIdLookupStrategy, clientCredentialLookupStrategy
- OIDC.SSO.MDDriven
- add RP-specific httpRequestMethodLookupStrategy, retrieveUserInfoEndpointClaimsPredicate, redirectUriOverrideLookupStrategy, responseModeLookupStrategy, tlsServerValidationSufficientPredicate, userInfoHttpRequestMethodLookupStrategy, scopesLookupStrategy, authenticationContextClassReferenceTranslationStrategyLookupStrategy, authenticationMethodsReferencesTranslationStrategyLookupStrategy
---
.../idp/service/relying-party/postconfig.xml | 432 +++++++++++++++++++++
1 file changed, 432 insertions(+)
diff --git a/oidc-config-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/oidc-config-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index 1a53c70..3154969 100644
--- a/oidc-config-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/oidc-config-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -105,7 +105,439 @@
</bean>
</property>
</bean>
+
+ <bean id="AbstractMDDrivenOIDCProfile" parent="AbstractMDDrivenProfile" abstract="true">
+ <property name="securityConfigurationLookupStrategy">
+ <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="securityConfiguration"
+ p:propertyType="#{T(org.opensaml.security.config.SecurityConfiguration)}"
+ p:defaultValue-ref="%{idp.security.oidc.config:shibboleth.oidc.DefaultSecurityConfiguration}" />
+ </property>
+ </bean>
+
+ <bean id="AbstractMDDrivenOAuthClientAuthenticatableProfile" parent="AbstractMDDrivenOIDCProfile" abstract="true">
+ <property name="claimsValidatorLookupStrategy">
+ <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="claimsValidator"
+ p:propertyType="#{T(net.shibboleth.oidc.jwt.claims.ClaimsValidator)}"
+ p:defaultValue="#{getObject('DefaultJWTClaimsValidator')}" />
+ </property>
+ <property name="forceAuthnPredicate">
+ <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="forceAuthn" />
+ </constructor-arg>
+ <constructor-arg>
+ <bean class="net.shibboleth.idp.saml.profile.config.logic.ProxyAwareForceAuthnPredicate" />
+ </constructor-arg>
+ </bean>
+ </property>
+ <property name="proxyCountLookupStrategy">
+ <bean parent="shibboleth.MDDrivenIntProperty" p:propertyName="proxyCount" />
+ </property>
+ <property name="authenticationFlowsLookupStrategy">
+ <bean parent="shibboleth.MDDrivenSetProperty" p:propertyName="authenticationFlows" />
+ </property>
+ <property name="postAuthenticationFlowsLookupStrategy">
+ <bean parent="shibboleth.MDDrivenListProperty" p:propertyName="postAuthenticationFlows" />
+ </property>
+ <property name="defaultAuthenticationMethodsLookupStrategy">
+ <bean parent="shibboleth.MDDrivenListProperty" p:propertyName="defaultAuthenticationMethods"
+ p:propertyType="#{T(net.shibboleth.oidc.authn.principal.AuthenticationContextClassReferencePrincipal)}">
+ <property name="defaultValueStrategy">
+ <bean class="net.shibboleth.oidc.profile.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassRequestLookupFunction"
+ p:mappings="#{getObject('shibboleth.oidc.PrincipalProxyRequestMappings')}" />
+ </property>
+ </bean>
+ </property>
+ <property name="messageHandlerLookupStrategy">
+ <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="messageHandler"
+ p:propertyType="#{T(java.util.function.Function)}" />
+ </property>
+ <property name="requireDpopProofPredicate">
+ <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="requireDpopProof" />
+ </constructor-arg>
+ <constructor-arg value="false" />
+ </bean>
+ </property>
+ <property name="dpopProofSignatureValidationConfigurationLookupStrategy">
+ <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="dpopProofSignatureValidationConfiguration"
+ p:propertyType="#{T(net.shibboleth.oidc.security.jose.SignatureValidationConfiguration)}"
+ p:defaultValue="#{getObject('DPoPSignatureValidationConfiguration')}" />
+ </property>
+ <property name="dpopProofNonceGeneratorLookupStrategy">
+ <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="dpopProofNonceGenerator"
+ p:propertyType="#{T(java.util.function.Function)}"
+ p:defaultValue="#{getObject('DefaultOAuth2DPoPNonceGenerator')}" />
+ </property>
+ </bean>
+
+ <bean id="AbstractMDDrivenOIDCFlowAwareProfile" parent="AbstractMDDrivenOAuthClientAuthenticatableProfile" abstract="true">
+ <property name="authorizationCodeFlowEnabledPredicate">
+ <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="authorizationCodeFlowEnabled" />
+ </constructor-arg>
+ <constructor-arg value="true" />
+ </bean>
+ </property>
+ <property name="implicitFlowEnabledPredicate">
+ <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="implicitFlowEnabled" />
+ </constructor-arg>
+ <constructor-arg value="true" />
+ </bean>
+ </property>
+ <property name="hybridFlowEnabledPredicate">
+ <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="hybridFlowEnabled" />
+ </constructor-arg>
+ <constructor-arg value="true" />
+ </bean>
+ </property>
+ <property name="refreshTokensEnabledPredicate">
+ <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="refreshTokensEnabled" />
+ </constructor-arg>
+ <constructor-arg value="true" />
+ </bean>
+ </property>
+ </bean>
+ <bean id="AbstractMDDrivenOIDCSSOProfile" parent="AbstractMDDrivenOIDCFlowAwareProfile" abstract="true">
+ <property name="issuerLookupStrategy">
+ <bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="issuer"
+ p:defaultValue="#{getObject('shibboleth.oidc.issuer')}" />
+ </property>
+ <property name="tokenEndpointAuthMethodsLookupStrategy">
+ <bean parent="shibboleth.MDDrivenSetProperty" p:propertyName="tokenEndpointAuthMethods">
+ <property name="defaultValue">
+ <bean parent="shibboleth.CommaDelimStringArray">
+ <constructor-arg type="java.lang.String"
+ value="%{idp.oidc.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}" />
+ </bean>
+ </property>
+ </bean>
+ </property>
+ <property name="resolveAttributesPredicate">
+ <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="resolveAttributes" />
+ </constructor-arg>
+ <constructor-arg value="true" />
+ </bean>
+ </property>
+ <property name="encryptionOptionalPredicate">
+ <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="encryptionOptional" />
+ </constructor-arg>
+ <constructor-arg value="%{idp.oidc.encryptionOptional:true}" />
+ </bean>
+ </property>
+ <property name="forcePKCEPredicate">
+ <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="forcePKCE" />
+ </constructor-arg>
+ <constructor-arg value="%{idp.oidc.forcePKCE:false}" />
+ </bean>
+ </property>
+ <property name="allowPKCEPlainPredicate">
+ <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="allowPKCEPlain" />
+ </constructor-arg>
+ <constructor-arg value="%{idp.oidc.allowPKCEPlain:false}" />
+ </bean>
+ </property>
+ <property name="iDTokenLifetimeLookupStrategy">
+ <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="IDTokenLifetime"
+ p:defaultValue="%{idp.oidc.idToken.defaultLifetime:PT1H}" />
+ </property>
+ <property name="accessTokenTypeLookupStrategy">
+ <bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="accessTokenType"
+ p:defaultValue="%{idp.oidc.accessToken.type:%{idp.oauth2.accessToken.type:}}" />
+ </property>
+ <property name="accessTokenLifetimeLookupStrategy">
+ <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="accessTokenLifetime"
+ p:defaultValue="%{idp.oidc.accessToken.defaultLifetime:PT10M}" />
+ </property>
+ <property name="refreshTokenTypeLookupStrategy">
+ <bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="refreshTokenType"
+ p:defaultValue="%{idp.oidc.accessToken.type:%{idp.oauth2.refreshTokenType.type:}}" />
+ </property>
+ <property name="additionalAudiencesForIdTokenLookupStrategy">
+ <bean parent="shibboleth.MDDrivenSetProperty" p:propertyName="tokenAudiences" />
+ </property>
+ <property name="alwaysIncludedAttributesLookupStrategy">
+ <bean parent="shibboleth.MDDrivenSetProperty" p:propertyName="alwaysIncludedAttributes">
+ <property name="defaultValue">
+ <bean parent="shibboleth.CommaDelimStringArray">
+ <constructor-arg type="java.lang.String" value="%{idp.oidc.alwaysIncludedAttributes:}" />
+ </bean>
+ </property>
+ </bean>
+ </property>
+ <property name="tokenEndpointAuthMethodLookupStrategy">
+ <bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="tokenEndpointAuthMethod"
+ p:defaultValue="%{idp.authn.oidc.rp.client.authenticationMethod:client_secret_basic}" />
+ </property>
+ <property name="useTargetedEndpointAsJWTAudiencePredicate">
+ <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="useTargetedEndpointAsJWTAudience" />
+ </constructor-arg>
+ <constructor-arg value="%{idp.oauth2.jwtAuth.targetedEndpointAsJWTAudience:false}" />
+ </bean>
+ </property>
+ <property name="clientIdLookupStrategy">
+ <bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="clientId"
+ p:defaultValue="#{%{idp.authn.oidc.rp.provider.discoveryRequired:false} == true ? null : '%{idp.authn.oidc.rp.client.clientId:}'}" />
+ </property>
+ <property name="clientCredentialLookupStrategy">
+ <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="clientCredential"
+ p:propertyType="#{T(java.util.function.Function)}"
+ p:defaultValue="#{%{idp.authn.oidc.rp.provider.discoveryRequired:false} == true ? {null} : getObject('shibboleth.authn.oidc.rp.DefaultCredential')}" />
+ </property>
+ <property name="iDTokenManipulationStrategyLookupStrategy">
+ <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="IDTokenManipulationStrategy"
+ p:propertyType="#{T(java.util.function.BiFunction)}" />
+ </property>
+ <property name="accessTokenClaimsSetManipulationStrategyLookupStrategy">
+ <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="accessTokenClaimsSetManipulationStrategy"
+ p:propertyType="#{T(java.util.function.BiFunction)}" />
+ </property>
+ <property name="unregisteredClientPolicyLookupStrategy">
+ <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="unregisteredClientPolicy"
+ p:propertyType="#{T(java.util.function.Function)}"
+ p:defaultValue="#{getObject('shibboleth.oidc.DefaultUnregisteredClientPolicy')}" />
+ </property>
+ <property name="dpopProofClaimsValidatorLookupStrategy">
+ <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="dpopProofClaimsValidator"
+ p:propertyType="#{T(net.shibboleth.oidc.jwt.claims.ClaimsValidator)}"
+ p:defaultValue="#{getObject('DefaultDPoPProofClaimsValidator')}" />
+ </property>
+ <property name="dpopProofSignatureValidationConfigurationLookupStrategy">
+ <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="dpopProofSignatureValidationConfiguration"
+ p:propertyType="#{T(net.shibboleth.oidc.security.jose.SignatureValidationConfiguration)}"
+ p:defaultValue="#{getObject('DPoPSignatureValidationConfiguration')}" />
+ </property>
+ <property name="dpopProofNonceGeneratorLookupStrategy">
+ <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="dpopProofNonceGenerator"
+ p:propertyType="#{T(java.util.function.Function)}"
+ p:defaultValue="#{getObject('DefaultOAuth2DPoPNonceGenerator')}" />
+ </property>
+ <property name="strictScopeValidationPredicate">
+ <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="strictScopeValidation" />
+ </constructor-arg>
+ <constructor-arg value="%{idp.oidc.strictScopeValidation:false}" />
+ </bean>
+ </property>
+ <property name="customRedirectUriValidationStrategyLookupStrategy">
+ <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="customRedirectUriValidationStrategy"
+ p:propertyType="#{T(java.util.function.BiPredicate)}" />
+ </property>
+ </bean>
+
+ <bean id="OIDC.SSO.MDDriven" parent="AbstractMDDrivenOIDCSSOProfile" lazy-init="true"
+ class="net.shibboleth.oidc.profile.config.impl.DefaultOIDCAuthorizationConfiguration">
+ <property name="acrRequestAlwaysEssentialPredicate">
+ <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="acrRequestAlwaysEssential" />
+ </constructor-arg>
+ <constructor-arg value="false" />
+ </bean>
+ </property>
+ <property name="encodeConsentInTokensPredicate">
+ <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="encodeConsentInTokens" />
+ </constructor-arg>
+ <constructor-arg value="%{idp.oidc.encodeConsentInTokens:false}" />
+ </bean>
+ </property>
+ <property name="authorizeCodeLifetimeLookupStrategy">
+ <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="authorizeCodeLifetime"
+ p:defaultValue="%{idp.oidc.authorizeCode.defaultLifetime:PT5M}" />
+ </property>
+ <property name="encodedAttributesLookupStrategy">
+ <bean parent="shibboleth.MDDrivenSetProperty" p:propertyName="encodedAttributes">
+ <property name="defaultValue">
+ <bean parent="shibboleth.CommaDelimStringArray">
+ <constructor-arg type="java.lang.String"
+ value="%{idp.oidc.encodedAttributes:%{idp.oidc.embeddedAttributes:}}" />
+ </bean>
+ </property>
+ </bean>
+ </property>
+ <property name="deniedUserInfoAttributesLookupStrategy">
+ <bean parent="shibboleth.MDDrivenSetProperty" p:propertyName="deniedUserInfoAttributes">
+ <property name="defaultValue">
+ <bean parent="shibboleth.CommaDelimStringArray">
+ <constructor-arg type="java.lang.String" value="%{idp.oidc.deniedUserInfoAttributes:}" />
+ </bean>
+ </property>
+ </bean>
+ </property>
+ <property name="httpRequestMethodLookupStrategy">
+ <bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="httpRequestMethod"
+ p:defaultValue="%{idp.authn.oidc.rp.httpRequestMethod:GET}" />
+ </property>
+ <property name="retrieveUserInfoEndpointClaimsPredicate">
+ <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="retrieveUserInfoEndpointClaims" />
+ </constructor-arg>
+ <constructor-arg value="%{idp.authn.oidc.rp.client.userinfo.enabled:true}" />
+ </bean>
+ </property>
+ <property name="redirectUriOverrideLookupStrategy">
+ <bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="redirectUriOverride"
+ p:defaultValue="{idp.authn.oidc.rp.client.redirectURI:#{null}}" />
+ </property>
+ <property name="refreshTokenTimeoutLookupStrategy">
+ <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="refreshTokenTimeout"
+ p:defaultValue="%{idp.oidc.refreshToken.defaultTimeout:%{idp.oidc.refreshToken.defaultLifetime:PT2H}}" />
+ </property>
+ <property name="refreshTokenChainLifetimeLookupStrategy">
+ <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="refreshTokenChainLifetime"
+ p:defaultValue="%{idp.oidc.refreshToken.defaultChainLifetime:PT2H}" />
+ </property>
+ <property name="includeIssuerInResponsePredicate">
+ <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="includeIssuerInResponse" />
+ </constructor-arg>
+ <constructor-arg value="false" />
+ </bean>
+ </property>
+ <property name="authorizationCodeClaimsSetManipulationStrategyLookupStrategy">
+ <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="authorizationCodeClaimsSetManipulationStrategy"
+ p:propertyType="#{T(java.util.function.BiFunction)}" />
+ </property>
+ <property name="securityConfigurationLookupStrategy">
+ <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="securityConfiguration"
+ p:propertyType="#{T(org.opensaml.security.config.SecurityConfiguration)}"
+ p:defaultValue-ref="%{idp.security.oidc.authorize.config:shibboleth.oidc.DefaultSecurityConfiguration}" />
+ </property>
+ <property name="encryptRequestObjectPredicate">
+ <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="encryptRequestObject" />
+ </constructor-arg>
+ <constructor-arg value="%{idp.oidc.requestobject.encrypted:false}" />
+ </bean>
+ </property>
+ <property name="signRequestObjectPredicate">
+ <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="signRequestObject" />
+ </constructor-arg>
+ <constructor-arg value="%{idp.oidc.requestobject.signed:true}" />
+ </bean>
+ </property>
+ <property name="useRequestObjectPredicate">
+ <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="useRequestObject" />
+ </constructor-arg>
+ <constructor-arg value="%{idp.oidc.requestobject.used:false}" />
+ </bean>
+ </property>
+ <property name="responseModeLookupStrategy">
+ <bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="responseMode"
+ p:defaultValue="%{idp.authn.oidc.rp.client.responseMode:#{null}}" />
+ </property>
+ <property name="tlsServerValidationSufficientPredicate">
+ <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="tlsServerValidationSufficient" />
+ </constructor-arg>
+ <constructor-arg value="%{idp.authn.oidc.rp.client.idtoken.tlsServerValidationOnly:false}" />
+ </bean>
+ </property>
+ <property name="userInfoHttpRequestMethodLookupStrategy">
+ <bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="userInfoHttpRequestMethod"
+ p:defaultValue="%{idp.authn.oidc.rp.client.userinfo.httpRequestMethod:GET}" />
+ </property>
+ <property name="scopesLookupStrategy">
+ <bean parent="shibboleth.MDDrivenSetProperty" p:propertyName="scopes">
+ <property name="defaultValue">
+ <bean parent="shibboleth.CommaDelimStringArray">
+ <constructor-arg type="java.lang.String"
+ value="{idp.authn.oidc.rp.client.scopes:#{null}}" />
+ </bean>
+ </property>
+ </bean>
+ </property>
+ <property name="responseModesLookupStrategy">
+ <bean parent="shibboleth.MDDrivenSetProperty" p:propertyName="responseModes">
+ <property name="defaultValue">
+ <bean parent="shibboleth.CommaDelimStringArray">
+ <constructor-arg type="java.lang.String"
+ value="%{idp.oauth2.responseModes:}" />
+ </bean>
+ </property>
+ </bean>
+ </property>
+ <property name="requireAuthenticationRequestPredicateLookupStrategy">
+ <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="requireAuthenticationRequestPredicate"
+ p:propertyType="#{T(java.util.function.Predicate)}"
+ p:defaultValue-ref="%{idp.oauth2.requireAuthenticationRequestPredicate:shibboleth.Conditions.TRUE}"/>
+ </property>
+ <property name="requirePushedAuthorizationRequestPredicate">
+ <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="requirePushedAuthorizationRequest" />
+ </constructor-arg>
+ <constructor-arg value="false" />
+ </bean>
+ </property>
+ <property name="requireDpopJktPredicate">
+ <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="requireDpopJkt" />
+ </constructor-arg>
+ <constructor-arg value="false" />
+ </bean>
+ </property>
+ <property name="authenticationContextClassReferenceTranslationStrategyLookupStrategy">
+ <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="authenticationContextClassReferenceTranslationStrategy"
+ p:propertyType="#{T(java.util.function.Function)}">
+ <property name="defaultValue">
+ <bean
+ class="net.shibboleth.oidc.profile.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction$LookupFunctionWrapper">
+ <constructor-arg>
+ <bean class="net.shibboleth.oidc.profile.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction"
+ c:mappings="#{getObject('shibboleth.oidc.PrincipalProxyResponseMappings')}"/>
+ </constructor-arg>
+ </bean>
+ </property>
+ </bean>
+ </property>
+ <property name="authenticationMethodsReferencesTranslationStrategyLookupStrategy">
+ <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="authenticationMethodsReferencesTranslationStrategy"
+ p:propertyType="#{T(java.util.function.Function)}">
+ <property name="defaultValue">
+ <bean
+ class="net.shibboleth.oidc.profile.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction$LookupFunctionWrapper">
+ <constructor-arg>
+ <bean class="net.shibboleth.oidc.profile.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction"
+ c:mappings="#{getObject('shibboleth.oidc.PrincipalProxyResponseMappings')}"/>
+ </constructor-arg>
+ </bean>
+ </property>
+ </bean>
+ </property>
+ </bean>
+
<!-- Keyset profile -->
<bean id="OIDC.Keyset" parent="AbstractOIDCProfile" lazy-init="true"
class="net.shibboleth.oidc.profile.config.impl.DefaultOIDCPublishKeySetConfiguration"
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list