[java-idp-oidc] branch main updated: JOIDC-242 - Require issuer value as JWT authentication audience by default
Henri Mikkonen
henri.mikkonen at iki.fi
Mon Jun 9 11:05:35 UTC 2025
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=40c5e88393fdc51a53497b054e41daec9c56deb4
The following commit(s) were added to refs/heads/main by this push:
new 40c5e883 JOIDC-242 - Require issuer value as JWT authentication audience by default
40c5e883 is described below
commit 40c5e88393fdc51a53497b054e41daec9c56deb4
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Mon Jun 9 14:05:00 2025 +0300
JOIDC-242 - Require issuer value as JWT authentication audience by default
https://shibboleth.atlassian.net/browse/JOIDC-242
- Wired 'JWTAuthenticationAudienceClaimsValidator' that supports the new profile configuration setting
- Wired 'idp.oauth2.jwtAuth.targetedEndpointAsJWTAudience' -property to OAUTH2.Introspection and OAUTH2.Revocation
- For other profiles the property is wired via oidc-config module
- Property defaults to false everywhere
- Add flow tests to cover the new setting
- Property in tests defaults to 'true','false'-value tested via RP-override
---
.../idp/service/relying-party/postconfig.xml | 4 +++-
.../AbstractOidcClientAuthenticationFlowTest.java | 19 +++++++++++++++++--
.../oidc/op/profile/flow/IntrospectionFlowTest.java | 1 +
.../oidc/op/profile/flow/PushedAuthorizeFlowTest.java | 1 +
.../oidc/op/profile/flow/RevocationFlowTest.java | 1 +
.../plugin/oidc/op/profile/flow/TokenFlowTest.java | 1 +
.../net/shibboleth/idp/module/conf/oidc.properties | 4 +++-
.../net/shibboleth/idp/module/conf/relying-party.xml | 11 +++++++++++
8 files changed, 38 insertions(+), 4 deletions(-)
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index 5df53a0a..94ff61cf 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -60,6 +60,7 @@
<bean id="OAUTH2.Introspection" parent="AbstractOIDCProfile" lazy-init="true"
class="net.shibboleth.oidc.profile.oauth2.config.impl.DefaultOAuth2TokenIntrospectionConfiguration"
p:issuer-ref="shibboleth.oidc.issuer"
+ p:useTargetedEndpointAsJWTAudience="%{idp.oauth2.jwtAuth.targetedEndpointAsJWTAudience:false}"
p:tokenEndpointAuthMethods="%{idp.oidc.dynreg.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}"
p:claimsValidator-ref="DefaultJWTClaimsValidator"
p:issuedClaimsValidator-ref="DefaultIntrospectionJWTClaimsValidator"
@@ -71,6 +72,7 @@
<bean id="OAUTH2.Revocation" parent="AbstractOIDCProfile" lazy-init="true"
class="net.shibboleth.oidc.profile.oauth2.config.impl.DefaultOAuth2TokenRevocationConfiguration"
p:issuer-ref="shibboleth.oidc.issuer"
+ p:useTargetedEndpointAsJWTAudience="%{idp.oauth2.jwtAuth.targetedEndpointAsJWTAudience:false}"
p:tokenEndpointAuthMethods="%{idp.oidc.dynreg.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}"
p:claimsValidator-ref="DefaultJWTClaimsValidator"
p:issuedClaimsValidator-ref="DefaultRevocationJWTClaimsValidator"
@@ -524,7 +526,7 @@
p:claimName="sub" p:valueToMatchLookupStrategy-ref="AdaptedRelyingPartyIdLookup" />
<bean id="DefaultAuthenticationAudienceClaimsValidator"
- class="net.shibboleth.oidc.security.jwt.claims.impl.AuthenticationAudienceClaimsValidator"
+ class="net.shibboleth.oidc.security.jwt.claims.impl.JWTAuthenticationAudienceClaimsValidator"
p:endpointTargets="%{idp.oauth2.jwtAuth.audienceValidator.endpointTargets:/profile/oauth2/introspection,/profile/oauth2/revocation,/profile/oauth2/pushed-authorization}"
p:endpointReplacement="/profile/oidc/token">
<property name="audienceLookupStrategy">
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcClientAuthenticationFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcClientAuthenticationFlowTest.java
index 07687665..8eaec760 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcClientAuthenticationFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcClientAuthenticationFlowTest.java
@@ -20,6 +20,7 @@ import java.security.PrivateKey;
import java.security.PublicKey;
import java.security.interfaces.RSAPrivateKey;
import java.time.Instant;
+import java.util.ArrayList;
import java.util.Date;
import java.util.List;
import java.util.Map;
@@ -60,6 +61,7 @@ public abstract class AbstractOidcClientAuthenticationFlowTest extends AbstractO
String clientIdSaml = "mockSamlClientId";
String clientSecretSaml = "mockClientSecretmockClientSecretmockClientSecret";
String clientIdDPoPProofEnforced = "mockClientIdDPoPProofEnforced";
+ String clientIdEndpointAudienceDisabled = "mockClientIdEndpointAudienceDisabled";
String jwtAud;
String issuer = "https://op.example.org";
@@ -76,7 +78,7 @@ public abstract class AbstractOidcClientAuthenticationFlowTest extends AbstractO
requestParameters.put("client_assertion", jwt.serialize());
requestParameters.put("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer");
}
-
+
@Test
public void testInvalidSecretJWT_missingSub() throws Exception {
for (final String id : clientIds) {
@@ -188,9 +190,22 @@ public abstract class AbstractOidcClientAuthenticationFlowTest extends AbstractO
}
}
+ @Test
+ public void testValidSecretJWTHS256_TokenEndpointAudience_endpointAudienceDisabled() throws Exception {
+ final SignedJWT jwt = createSecretJWT(validClaimsSet(clientIdEndpointAudienceDisabled,
+ "http://localhost/idp/profile/oidc/token"),
+ clientSecret, JWSAlgorithm.HS256);
+ final FlowExecutionResult result = launchWithJwtAuthentication(jwt, null,
+ ClientAuthenticationMethod.CLIENT_SECRET_JWT);
+ assertErrorCode(result, getErrorDetaisForJWTValidation().getFirst());
+ assertErrorDescriptionContains(result, getErrorDetaisForJWTValidation().getSecond());
+ }
+
@Test
public void testValidSecretJWTHS256_IssuerAudience() throws Exception {
- for (final String id : clientIds) {
+ final List<String> ids = new ArrayList<>(clientIds);
+ ids.add(clientIdEndpointAudienceDisabled);
+ for (final String id : ids) {
final SignedJWT jwt = createSecretJWT(validClaimsSet(id, issuer), clientSecret, JWSAlgorithm.HS256);
final FlowExecutionResult result = launchWithJwtAuthentication(jwt, null,
ClientAuthenticationMethod.CLIENT_SECRET_JWT);
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IntrospectionFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IntrospectionFlowTest.java
index f727fe7a..b69cbdd1 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IntrospectionFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IntrospectionFlowTest.java
@@ -90,6 +90,7 @@ public class IntrospectionFlowTest extends AbstractOidcClientAuthenticationFlowT
removeMetadata(storageService, clientId);
removeMetadata(storageService, clientIdNotMDDriven);
removeMetadata(storageService, clientIdDPoPProofEnforced);
+ removeMetadata(storageService, clientIdEndpointAudienceDisabled);
}
@Test
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/PushedAuthorizeFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/PushedAuthorizeFlowTest.java
index 966ad550..ebcee2f6 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/PushedAuthorizeFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/PushedAuthorizeFlowTest.java
@@ -105,6 +105,7 @@ public class PushedAuthorizeFlowTest extends AbstractOidcClientAuthenticationFlo
removeMetadata(storageService, clientIdNotMDDriven);
removeMetadata(storageService, "mockPublicClientIdPKCEPlainUnforced");
removeMetadata(storageService, "mockClientIdDPoPAccessToken");
+ removeMetadata(storageService, clientIdEndpointAudienceDisabled);
}
@Test
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RevocationFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RevocationFlowTest.java
index 1a4a15a8..1be0d836 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RevocationFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RevocationFlowTest.java
@@ -88,6 +88,7 @@ public class RevocationFlowTest extends AbstractOidcClientAuthenticationFlowTest
removeMetadata(storageService, clientIdNotMDDriven);
removeMetadata(storageService, clientIdSingle);
removeMetadata(storageService, clientIdDPoPProofEnforced);
+ removeMetadata(storageService, clientIdEndpointAudienceDisabled);
}
@Test
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
index 09c30c48..c2b64a1a 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
@@ -139,6 +139,7 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
removeMetadata(storageService, clientIdDPoPJwtAccessToken);
removeMetadata(storageService, clientIdDPoPJwtBearerAccessToken);
removeMetadata(storageService, clientIdAlwaysBearerAccessToken);
+ removeMetadata(storageService, clientIdEndpointAudienceDisabled);
}
@Test
diff --git a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/oidc.properties b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/oidc.properties
index fca79757..d2e0c884 100644
--- a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/oidc.properties
+++ b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/oidc.properties
@@ -20,4 +20,6 @@ idp.oauth2.defaultAllowedAudience = https://rp.example.org
idp.oidc.discovery.resolver.values = CustomConfigurationValues
-idp.oidc.DefaultUnregisteredClientPolicyFile = src/test/resources/net/shibboleth/idp/module/conf/unregistered-policy.json
\ No newline at end of file
+idp.oidc.DefaultUnregisteredClientPolicyFile = src/test/resources/net/shibboleth/idp/module/conf/unregistered-policy.json
+
+idp.oauth2.jwtAuth.targetedEndpointAsJWTAudience = true
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/relying-party.xml b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/relying-party.xml
index 08cec303..093937a4 100644
--- a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/relying-party.xml
+++ b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/relying-party.xml
@@ -76,6 +76,17 @@
</bean>
<util:list id="shibboleth.RelyingPartyOverrides">
+ <bean parent="RelyingPartyByName" c:relyingPartyIds="mockClientIdEndpointAudienceDisabled">
+ <property name="profileConfigurations">
+ <list>
+ <bean parent="OIDC.SSO" p:responseModes="fragment" p:useTargetedEndpointAsJWTAudience="false"/>
+ <bean parent="OAUTH2.Token.MDDriven" p:useTargetedEndpointAsJWTAudience="false"/>
+ <bean parent="OAUTH2.Introspection.MDDriven" p:useTargetedEndpointAsJWTAudience="false"/>
+ <bean parent="OAUTH2.Revocation.MDDriven" p:useTargetedEndpointAsJWTAudience="false"/>
+ <bean parent="OAUTH2.PAR.MDDriven" p:useTargetedEndpointAsJWTAudience="false"/>
+ </list>
+ </property>
+ </bean>
<bean parent="RelyingPartyByName" c:relyingPartyIds="mockClientIdFragmentResponseMode">
<property name="profileConfigurations">
<list>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list