[java-idp-plugin-oidc-config] branch main updated: JOIDCCONF-8 - Add new client authentication assertion options

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-plugin-oidc-config.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-config.git;a=commit;h=b8fb54034b188d5c45ef31b352f2c1d77b491999

The following commit(s) were added to refs/heads/main by this push:
     new b8fb540  JOIDCCONF-8 - Add new client authentication assertion options
b8fb540 is described below

commit b8fb54034b188d5c45ef31b352f2c1d77b491999
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Mon Jun 16 16:58:58 2025 +0300

    JOIDCCONF-8 - Add new client authentication assertion options
    
    https://shibboleth.atlassian.net/browse/JOIDCCONF-8
    
    - Wire 'idp.oauth2.jwtAuth.requireSingleJWTAudience', default to 'false'
---
 .../net/shibboleth/idp/service/relying-party/postconfig.xml      | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/oidc-config-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/oidc-config-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index 2e036d4..c8a1659 100644
--- a/oidc-config-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/oidc-config-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -52,6 +52,7 @@
         p:alwaysIncludedAttributes="%{idp.oidc.alwaysIncludedAttributes:}"        
         p:tokenEndpointAuthMethod="%{idp.authn.oidc.rp.client.authenticationMethod:client_secret_basic}"
         p:useTargetedEndpointAsJWTAudience="%{idp.oauth2.jwtAuth.targetedEndpointAsJWTAudience:true}"
+        p:requireSingleJWTAudience="%{idp.oauth2.jwtAuth.requireSingleJWTAudience:false}"
         p:clientId="#{%{idp.authn.oidc.rp.provider.discoveryRequired:false} == true ? null : '%{idp.authn.oidc.rp.client.clientId:}'}"
         p:clientCredential="#{%{idp.authn.oidc.rp.provider.discoveryRequired:false} == true ? {null} : getObject('shibboleth.authn.oidc.rp.DefaultCredential')}"
         p:unregisteredClientPolicy="#{getObject('shibboleth.oidc.DefaultUnregisteredClientPolicy')}"
@@ -178,6 +179,14 @@
                 <constructor-arg value="%{idp.oauth2.jwtAuth.targetedEndpointAsJWTAudience:true}" />
             </bean>
         </property>
+        <property name="requireSingleJWTAudiencePredicate">
+            <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+                <constructor-arg>
+                    <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="requireSingleJWTAudience" />
+                </constructor-arg>
+                <constructor-arg value="%{idp.oauth2.jwtAuth.requireSingleJWTAudience:false}" />
+            </bean>
+        </property>
     </bean>
 
     <bean id="AbstractMDDrivenOIDCFlowAwareProfile" parent="AbstractMDDrivenOAuthClientAuthenticatableProfile" abstract="true">

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.