[java-idp-oidc] 02/02: JOIDC-241 - Inherit OIDC.SSO.MDDriven and its abstract beans from oidc-config
Henri Mikkonen
henri.mikkonen at iki.fi
Thu Jun 5 13:56:59 UTC 2025
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=655d48e729fa4a035b5dd5e6e4be8ce607bf9535
commit 655d48e729fa4a035b5dd5e6e4be8ce607bf9535
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Thu Jun 5 16:55:20 2025 +0300
JOIDC-241 - Inherit OIDC.SSO.MDDriven and its abstract beans from oidc-config
https://shibboleth.atlassian.net/browse/JOIDC-241
Removed OIDC.SSO.MDDriven -bean from relying-party/postconfig.xml as it's now provided by oidc-config.
Also removed its parent beans AbstractMDDrivenOIDCProfile, AbstractMDDrivenOAuthClientAuthenticatableProfile, AbstractMDDrivenOIDCFlowAwareProfile and AbstractMDDrivenOIDCSSOProfile.
---
.../idp/service/relying-party/postconfig.xml | 330 +--------------------
1 file changed, 1 insertion(+), 329 deletions(-)
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index 0a84da41..5df53a0a 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -107,65 +107,6 @@
class="net.shibboleth.idp.plugin.oidc.op.profile.logic.DefaultLogoutHintMatchingPredicate"/>
<!-- Metadata-driven variants. -->
-
- <bean id="AbstractMDDrivenOIDCProfile" parent="AbstractMDDrivenProfile" abstract="true">
- <property name="securityConfigurationLookupStrategy">
- <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="securityConfiguration"
- p:propertyType="#{T(org.opensaml.security.config.SecurityConfiguration)}"
- p:defaultValue-ref="%{idp.security.oidc.config:shibboleth.oidc.DefaultSecurityConfiguration}" />
- </property>
- </bean>
-
- <bean id="AbstractMDDrivenOAuthClientAuthenticatableProfile" parent="AbstractMDDrivenOIDCProfile" abstract="true">
- <property name="claimsValidatorLookupStrategy">
- <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="claimsValidator"
- p:propertyType="#{T(net.shibboleth.oidc.jwt.claims.ClaimsValidator)}"
- p:defaultValue-ref="DefaultJWTClaimsValidator" />
- </property>
- <property name="forceAuthnPredicate">
- <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
- <constructor-arg>
- <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="forceAuthn" />
- </constructor-arg>
- <constructor-arg value="false" />
- </bean>
- </property>
- <property name="proxyCountLookupStrategy">
- <bean parent="shibboleth.MDDrivenIntProperty" p:propertyName="proxyCount" />
- </property>
- <property name="authenticationFlowsLookupStrategy">
- <bean parent="shibboleth.MDDrivenSetProperty" p:propertyName="authenticationFlows" />
- </property>
- <property name="postAuthenticationFlowsLookupStrategy">
- <bean parent="shibboleth.MDDrivenListProperty" p:propertyName="postAuthenticationFlows" />
- </property>
- <property name="defaultAuthenticationMethodsLookupStrategy">
- <bean parent="shibboleth.MDDrivenListProperty" p:propertyName="defaultAuthenticationMethods"
- p:propertyType="#{T(net.shibboleth.oidc.authn.principal.AuthenticationContextClassReferencePrincipal)}" />
- </property>
- <property name="messageHandlerLookupStrategy">
- <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="messageHandler"
- p:propertyType="#{T(java.util.function.Function)}" />
- </property>
- <property name="requireDpopProofPredicate">
- <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
- <constructor-arg>
- <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="requireDpopProof" />
- </constructor-arg>
- <constructor-arg value="false" />
- </bean>
- </property>
- <property name="dpopProofSignatureValidationConfigurationLookupStrategy">
- <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="dpopProofSignatureValidationConfiguration"
- p:propertyType="#{T(net.shibboleth.oidc.security.jose.SignatureValidationConfiguration)}"
- p:defaultValue-ref="DPoPSignatureValidationConfiguration" />
- </property>
- <property name="dpopProofNonceGeneratorLookupStrategy">
- <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="dpopProofNonceGenerator"
- p:propertyType="#{T(java.util.function.Function)}"
- p:defaultValue-ref="DefaultOAuth2DPoPNonceGenerator" />
- </property>
- </bean>
<bean id="AbstractMDDrivenOAuthTokenValidatingProfile" parent="AbstractMDDrivenOAuthClientAuthenticatableProfile" abstract="true">
<property name="issuerLookupStrategy">
@@ -177,276 +118,7 @@
p:defaultValue-ref="DefaultDPoPWithAthProofClaimsValidator" />
</property>
</bean>
-
- <bean id="AbstractMDDrivenOIDCFlowAwareProfile" parent="AbstractMDDrivenOAuthClientAuthenticatableProfile" abstract="true">
- <property name="authorizationCodeFlowEnabledPredicate">
- <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
- <constructor-arg>
- <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="authorizationCodeFlowEnabled" />
- </constructor-arg>
- <constructor-arg value="true" />
- </bean>
- </property>
- <property name="implicitFlowEnabledPredicate">
- <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
- <constructor-arg>
- <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="implicitFlowEnabled" />
- </constructor-arg>
- <constructor-arg value="true" />
- </bean>
- </property>
- <property name="hybridFlowEnabledPredicate">
- <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
- <constructor-arg>
- <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="hybridFlowEnabled" />
- </constructor-arg>
- <constructor-arg value="true" />
- </bean>
- </property>
- <property name="refreshTokensEnabledPredicate">
- <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
- <constructor-arg>
- <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="refreshTokensEnabled" />
- </constructor-arg>
- <constructor-arg value="true" />
- </bean>
- </property>
- </bean>
-
- <bean id="AbstractMDDrivenOIDCSSOProfile" parent="AbstractMDDrivenOIDCFlowAwareProfile" abstract="true">
- <property name="issuerLookupStrategy">
- <bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="issuer" p:defaultValue-ref="shibboleth.oidc.issuer" />
- </property>
- <property name="tokenEndpointAuthMethodsLookupStrategy">
- <bean parent="shibboleth.MDDrivenSetProperty" p:propertyName="tokenEndpointAuthMethods">
- <property name="defaultValue">
- <bean parent="shibboleth.CommaDelimStringArray">
- <constructor-arg type="java.lang.String"
- value="%{idp.oidc.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}" />
- </bean>
- </property>
- </bean>
- </property>
- <property name="resolveAttributesPredicate">
- <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
- <constructor-arg>
- <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="resolveAttributes" />
- </constructor-arg>
- <constructor-arg value="true" />
- </bean>
- </property>
- <property name="encryptionOptionalPredicate">
- <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
- <constructor-arg>
- <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="encryptionOptional" />
- </constructor-arg>
- <constructor-arg value="%{idp.oidc.encryptionOptional:true}" />
- </bean>
- </property>
- <property name="forcePKCEPredicate">
- <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
- <constructor-arg>
- <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="forcePKCE" />
- </constructor-arg>
- <constructor-arg value="%{idp.oidc.forcePKCE:false}" />
- </bean>
- </property>
- <property name="allowPKCEPlainPredicate">
- <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
- <constructor-arg>
- <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="allowPKCEPlain" />
- </constructor-arg>
- <constructor-arg value="%{idp.oidc.allowPKCEPlain:false}" />
- </bean>
- </property>
- <property name="iDTokenLifetimeLookupStrategy">
- <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="IDTokenLifetime"
- p:defaultValue="%{idp.oidc.idToken.defaultLifetime:PT1H}" />
- </property>
- <property name="accessTokenTypeLookupStrategy">
- <bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="accessTokenType"
- p:defaultValue="%{idp.oidc.accessToken.type:%{idp.oauth2.accessToken.type:}}" />
- </property>
- <property name="accessTokenLifetimeLookupStrategy">
- <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="accessTokenLifetime"
- p:defaultValue="%{idp.oidc.accessToken.defaultLifetime:PT10M}" />
- </property>
- <property name="additionalAudiencesForIdTokenLookupStrategy">
- <bean parent="shibboleth.MDDrivenSetProperty" p:propertyName="tokenAudiences" />
- </property>
- <property name="alwaysIncludedAttributesLookupStrategy">
- <bean parent="shibboleth.MDDrivenSetProperty" p:propertyName="alwaysIncludedAttributes">
- <property name="defaultValue">
- <bean parent="shibboleth.CommaDelimStringArray">
- <constructor-arg type="java.lang.String" value="%{idp.oidc.alwaysIncludedAttributes:}" />
- </bean>
- </property>
- </bean>
- </property>
- <property name="iDTokenManipulationStrategyLookupStrategy">
- <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="IDTokenManipulationStrategy"
- p:propertyType="#{T(java.util.function.BiFunction)}" />
- </property>
- <property name="accessTokenClaimsSetManipulationStrategyLookupStrategy">
- <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="accessTokenClaimsSetManipulationStrategy"
- p:propertyType="#{T(java.util.function.BiFunction)}" />
- </property>
- <property name="unregisteredClientPolicyLookupStrategy">
- <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="unregisteredClientPolicy"
- p:propertyType="#{T(java.util.function.Function)}"
- p:defaultValue-ref="shibboleth.oidc.DefaultUnregisteredClientPolicy" />
- </property>
- <property name="dpopProofClaimsValidatorLookupStrategy">
- <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="dpopProofClaimsValidator"
- p:propertyType="#{T(net.shibboleth.oidc.jwt.claims.ClaimsValidator)}"
- p:defaultValue-ref="DefaultDPoPProofClaimsValidator" />
- </property>
- <property name="dpopProofSignatureValidationConfigurationLookupStrategy">
- <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="dpopProofSignatureValidationConfiguration"
- p:propertyType="#{T(net.shibboleth.oidc.security.jose.SignatureValidationConfiguration)}"
- p:defaultValue-ref="DPoPSignatureValidationConfiguration" />
- </property>
- <property name="dpopProofNonceGeneratorLookupStrategy">
- <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="dpopProofNonceGenerator"
- p:propertyType="#{T(java.util.function.Function)}"
- p:defaultValue-ref="DefaultOAuth2DPoPNonceGenerator" />
- </property>
- <property name="strictScopeValidationPredicate">
- <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
- <constructor-arg>
- <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="strictScopeValidation" />
- </constructor-arg>
- <constructor-arg value="%{idp.oidc.strictScopeValidation:false}" />
- </bean>
- </property>
- <property name="customRedirectUriValidationStrategyLookupStrategy">
- <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="customRedirectUriValidationStrategy"
- p:propertyType="#{T(java.util.function.BiPredicate)}" />
- </property>
- </bean>
-
- <bean id="OIDC.SSO.MDDriven" parent="AbstractMDDrivenOIDCSSOProfile" lazy-init="true"
- class="net.shibboleth.oidc.profile.config.impl.DefaultOIDCAuthorizationConfiguration">
- <property name="acrRequestAlwaysEssentialPredicate">
- <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
- <constructor-arg>
- <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="acrRequestAlwaysEssential" />
- </constructor-arg>
- <constructor-arg value="false" />
- </bean>
- </property>
- <property name="encodeConsentInTokensPredicate">
- <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
- <constructor-arg>
- <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="encodeConsentInTokens" />
- </constructor-arg>
- <constructor-arg value="%{idp.oidc.encodeConsentInTokens:false}" />
- </bean>
- </property>
- <property name="authorizeCodeLifetimeLookupStrategy">
- <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="authorizeCodeLifetime"
- p:defaultValue="%{idp.oidc.authorizeCode.defaultLifetime:PT5M}" />
- </property>
- <property name="encodedAttributesLookupStrategy">
- <bean parent="shibboleth.MDDrivenSetProperty" p:propertyName="encodedAttributes">
- <property name="defaultValue">
- <bean parent="shibboleth.CommaDelimStringArray">
- <constructor-arg type="java.lang.String"
- value="%{idp.oidc.encodedAttributes:%{idp.oidc.embeddedAttributes:}}" />
- </bean>
- </property>
- </bean>
- </property>
- <property name="deniedUserInfoAttributesLookupStrategy">
- <bean parent="shibboleth.MDDrivenSetProperty" p:propertyName="deniedUserInfoAttributes">
- <property name="defaultValue">
- <bean parent="shibboleth.CommaDelimStringArray">
- <constructor-arg type="java.lang.String" value="%{idp.oidc.deniedUserInfoAttributes:}" />
- </bean>
- </property>
- </bean>
- </property>
- <property name="refreshTokenTimeoutLookupStrategy">
- <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="refreshTokenTimeout"
- p:defaultValue="%{idp.oidc.refreshToken.defaultTimeout:%{idp.oidc.refreshToken.defaultLifetime:PT2H}}" />
- </property>
- <property name="refreshTokenChainLifetimeLookupStrategy">
- <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="refreshTokenChainLifetime"
- p:defaultValue="%{idp.oidc.refreshToken.defaultChainLifetime:PT2H}" />
- </property>
- <property name="includeIssuerInResponsePredicate">
- <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
- <constructor-arg>
- <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="includeIssuerInResponse" />
- </constructor-arg>
- <constructor-arg value="false" />
- </bean>
- </property>
- <property name="authorizationCodeClaimsSetManipulationStrategyLookupStrategy">
- <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="authorizationCodeClaimsSetManipulationStrategy"
- p:propertyType="#{T(java.util.function.BiFunction)}" />
- </property>
- <property name="securityConfigurationLookupStrategy">
- <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="securityConfiguration"
- p:propertyType="#{T(org.opensaml.security.config.SecurityConfiguration)}"
- p:defaultValue-ref="%{idp.security.oidc.authorize.config:shibboleth.oidc.DefaultSecurityConfiguration}" />
- </property>
- <property name="encryptRequestObjectPredicate">
- <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
- <constructor-arg>
- <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="encryptRequestObject" />
- </constructor-arg>
- <constructor-arg value="%{idp.oidc.requestobject.encrypted:false}" />
- </bean>
- </property>
- <property name="signRequestObjectPredicate">
- <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
- <constructor-arg>
- <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="signRequestObject" />
- </constructor-arg>
- <constructor-arg value="%{idp.oidc.requestobject.signed:true}" />
- </bean>
- </property>
- <property name="useRequestObjectPredicate">
- <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
- <constructor-arg>
- <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="useRequestObject" />
- </constructor-arg>
- <constructor-arg value="%{idp.oidc.requestobject.used:false}" />
- </bean>
- </property>
- <property name="responseModesLookupStrategy">
- <bean parent="shibboleth.MDDrivenSetProperty" p:propertyName="responseModes">
- <property name="defaultValue">
- <bean parent="shibboleth.CommaDelimStringArray">
- <constructor-arg type="java.lang.String"
- value="%{idp.oauth2.responseModes:}" />
- </bean>
- </property>
- </bean>
- </property>
- <property name="requireAuthenticationRequestPredicateLookupStrategy">
- <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="requireAuthenticationRequestPredicate"
- p:propertyType="#{T(java.util.function.Predicate)}"
- p:defaultValue-ref="%{idp.oauth2.requireAuthenticationRequestPredicate:shibboleth.Conditions.TRUE}"/>
- </property>
- <property name="requirePushedAuthorizationRequestPredicate">
- <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
- <constructor-arg>
- <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="requirePushedAuthorizationRequest" />
- </constructor-arg>
- <constructor-arg value="false" />
- </bean>
- </property>
- <property name="requireDpopJktPredicate">
- <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
- <constructor-arg>
- <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="requireDpopJkt" />
- </constructor-arg>
- <constructor-arg value="false" />
- </bean>
- </property>
- </bean>
+
<bean id="OIDC.UserInfo.MDDriven" parent="AbstractMDDrivenOIDCProfile" lazy-init="true"
class="net.shibboleth.oidc.profile.config.impl.DefaultOIDCUserInfoConfiguration">
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list