[java-idp-oidc] branch main updated: JOIDC-235 - AdministrativeLogoutConfiguration for OIDC

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=628d05df08f196828ccc0bc6d0036b4ee7780cdd

The following commit(s) were added to refs/heads/main by this push:
     new 628d05df JOIDC-235 - AdministrativeLogoutConfiguration for OIDC
628d05df is described below

commit 628d05df08f196828ccc0bc6d0036b4ee7780cdd
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Wed Jun 11 18:31:57 2025 +0300

    JOIDC-235 - AdministrativeLogoutConfiguration for OIDC
    
    https://shibboleth.atlassian.net/browse/JOIDC-235
    
    Combined two properties idp.oauth2.revocationCondition and idp.oauth2.revocationCondition.custom into one: idp.oauth2.revocationCondition
    - Bean ID to implement the condition (BiPredicate<ProfileRequestContext,JWTClaimsSet>): defaults to shibboleth.BiConditions.FALSE
---
 .../META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml    | 2 +-
 .../net/shibboleth/idp/service/relying-party/postconfig.xml         | 2 +-
 .../net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties          | 6 ++----
 .../test/resources/net/shibboleth/idp/module/conf/oidc.properties   | 3 +--
 4 files changed, 5 insertions(+), 8 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
index 49d8b38f..51d086b8 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
@@ -78,7 +78,7 @@
         p:replayCache-ref="shibboleth.ReplayCache"
         p:revocationCache-ref="shibboleth.oidc.RevocationCache"
         p:refreshTokenDeserializers-ref="#{'%{idp.oauth2.refreshToken.deserializers:shibboleth.oidc.DefaultRefreshTokenDeserializers}'.trim()}"
-        p:tokenRevocationCondition="#{%{idp.oauth2.revocationCondition:false} == true ? getObject('%{idp.oauth2.revocationCondition.custom:shibboleth.oauth2.revocationCondition.AttributeTokenRevocationCondition}') : {null} }">
+        p:tokenRevocationCondition="#{getObject('%{idp.oauth2.revocationCondition:shibboleth.BiConditions.FALSE}')}">
         <property name="chainRevocationLifetimeLookupStrategy">
             <bean class="net.shibboleth.idp.plugin.oidc.op.profile.logic.DefaultChainRevocationLifetimeLookupStrategy"
                 p:clockSkew="%{idp.policy.clockSkew:PT5M}" p:useActiveProfileOnly="false" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index 9f98a984..ff57e024 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -603,7 +603,7 @@
 
     <bean id="TokenRevocationConditionValidator"
         class="net.shibboleth.idp.plugin.oidc.op.security.jwt.claims.impl.TokenRevocationConditionValidator"
-        p:tokenRevocationCondition="#{%{idp.oauth2.revocationCondition:false} == true ? getObject('%{idp.oauth2.revocationCondition.custom:shibboleth.oauth2.revocationCondition.AttributeTokenRevocationCondition}') : {null} }">
+        p:tokenRevocationCondition="#{getObject('%{idp.oauth2.revocationCondition:shibboleth.BiConditions.FALSE}')}">
     </bean>
 
     <util:list id="IntrospectionClaimsValidators" value-type="net.shibboleth.oidc.jwt.claims.ClaimsValidator">
diff --git a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
index 6462997f..8ebb849b 100644
--- a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
+++ b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
@@ -198,10 +198,8 @@ idp.oidc.subject.salt = this_too_should_be_ch4ng3d
 # Revocation method: set to TOKEN to revoke single tokens (defaults to full chain (value = CHAIN))
 #idp.oauth2.revocationMethod = TOKEN
 
-# Revocation condition: activate (disabled by default) and modify the attribute resolution parameters
-#idp.oauth2.revocationCondition = false
-# Custom bean name that implements BiPredicate<ProfileRequestContext,JWTClaimsSet> for activating condition
-#idp.oauth2.revocationCondition.custom = shibboleth.oauth2.revocationCondition.AttributeTokenRevocationCondition
+# Revocation condition: bean name that implements BiPredicate<ProfileRequestContext,JWTClaimsSet> for activating condition (defaults to shibboleth.BiConditions.FALSE)
+#idp.oauth2.revocationCondition = shibboleth.oauth2.revocationCondition.AttributeTokenRevocationCondition
 # The attribute ID for the shibboleth.oauth2.revocationCondition.AttributeTokenRevocationCondition
 #idp.oauth2.revocationCondition.attributeId = revocation
 
diff --git a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/oidc.properties b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/oidc.properties
index 2897761d..358776e4 100644
--- a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/oidc.properties
+++ b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/oidc.properties
@@ -23,6 +23,5 @@ idp.oidc.discovery.resolver.values = CustomConfigurationValues
 idp.oidc.DefaultUnregisteredClientPolicyFile = src/test/resources/net/shibboleth/idp/module/conf/unregistered-policy.json
 
 idp.oauth2.jwtAuth.targetedEndpointAsJWTAudience = true
-idp.oauth2.revocationCondition = true
-idp.oauth2.revocationCondition.custom = CustomTokenRevocationCondition
+idp.oauth2.revocationCondition = CustomTokenRevocationCondition
 idp.oauth2.revocationCondition.attributeId = customRevocation
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.