[java-idp-oidc] branch main updated: JOIDC-242 - Support new profile configuration options for JWT authentication audience
Henri Mikkonen
henri.mikkonen at iki.fi
Mon Jun 16 14:10:21 UTC 2025
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=e6b7abb2a4185ba291fad8931c6e8105a9e3d45a
The following commit(s) were added to refs/heads/main by this push:
new e6b7abb2 JOIDC-242 - Support new profile configuration options for JWT authentication audience
e6b7abb2 is described below
commit e6b7abb2a4185ba291fad8931c6e8105a9e3d45a
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Mon Jun 16 17:10:06 2025 +0300
JOIDC-242 - Support new profile configuration options for JWT authentication audience
https://shibboleth.atlassian.net/browse/JOIDC-242
Wired requireSingleJWTAudience to DefaultAuthenticationAudienceClaimsValidator
- Included flow tests to all flows involving client authentication
---
.../shibboleth/idp/service/relying-party/postconfig.xml | 5 +++++
.../flow/AbstractOidcClientAuthenticationFlowTest.java | 17 +++++++++++++++++
.../oidc/op/profile/flow/IntrospectionFlowTest.java | 1 +
.../oidc/op/profile/flow/PushedAuthorizeFlowTest.java | 1 +
.../plugin/oidc/op/profile/flow/RevocationFlowTest.java | 1 +
.../idp/plugin/oidc/op/profile/flow/TokenFlowTest.java | 1 +
.../net/shibboleth/idp/module/conf/relying-party.xml | 11 +++++++++++
7 files changed, 37 insertions(+)
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index e63f1fc8..5dbc86ee 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -61,6 +61,7 @@
class="net.shibboleth.oidc.profile.oauth2.config.impl.DefaultOAuth2TokenIntrospectionConfiguration"
p:issuer-ref="shibboleth.oidc.issuer"
p:useTargetedEndpointAsJWTAudience="%{idp.oauth2.jwtAuth.targetedEndpointAsJWTAudience:false}"
+ p:requireSingleJWTAudience="%{idp.oauth2.jwtAuth.requireSingleJWTAudience:false}"
p:tokenEndpointAuthMethods="%{idp.oidc.dynreg.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}"
p:claimsValidator-ref="DefaultJWTClaimsValidator"
p:issuedClaimsValidator-ref="DefaultIntrospectionJWTClaimsValidator"
@@ -73,6 +74,7 @@
class="net.shibboleth.oidc.profile.oauth2.config.impl.DefaultOAuth2TokenRevocationConfiguration"
p:issuer-ref="shibboleth.oidc.issuer"
p:useTargetedEndpointAsJWTAudience="%{idp.oauth2.jwtAuth.targetedEndpointAsJWTAudience:false}"
+ p:requireSingleJWTAudience="%{idp.oauth2.jwtAuth.requireSingleJWTAudience:false}"
p:tokenEndpointAuthMethods="%{idp.oidc.dynreg.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}"
p:claimsValidator-ref="DefaultJWTClaimsValidator"
p:issuedClaimsValidator-ref="DefaultRevocationJWTClaimsValidator"
@@ -534,6 +536,9 @@
c:expression="#custom.get().getRequestURL().toString()"
p:customObject-ref="shibboleth.HttpServletRequestSupplier" />
</property>
+ <property name="extraAudienceValidationCondition">
+ <bean class="net.shibboleth.oidc.profile.config.navigate.RequireSingleJWTAudienceLookupFunction"/>
+ </property>
</bean>
<bean id="JWTIdentifierClaimsValidator"
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcClientAuthenticationFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcClientAuthenticationFlowTest.java
index fe40a174..ec5a73d9 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcClientAuthenticationFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcClientAuthenticationFlowTest.java
@@ -63,6 +63,7 @@ public abstract class AbstractOidcClientAuthenticationFlowTest extends AbstractO
String clientIdDPoPProofEnforced = "mockClientIdDPoPProofEnforced";
String clientIdEndpointAudienceDisabled = "mockClientIdEndpointAudienceDisabled";
String clientIdRequireClientAuthenticationJWTType = "mockClientIdRequireClientAuthenticationJWTType";
+ String clientIdExtraAudienceDisabled = "mockClientIdExtraAudienceDisabled";
String jwtAud;
String issuer = "https://op.example.org";
@@ -214,6 +215,22 @@ public abstract class AbstractOidcClientAuthenticationFlowTest extends AbstractO
}
}
+ @Test
+ public void testValidSecretJWTHS256_IssuerAudienceExtraDisabled() throws Exception {
+ final String id = clientIdExtraAudienceDisabled;
+ final SignedJWT jwt = createSecretJWT(new JWTClaimsSet.Builder()
+ .subject(id)
+ .issuer(id)
+ .audience(List.of(issuer, "https://op.example.org/extra"))
+ .expirationTime(Date.from(Instant.now().plusSeconds(600)))
+ .jwtID(idGenerator.generateIdentifier())
+ .build(), clientSecret, JWSAlgorithm.HS256);
+ final FlowExecutionResult result = launchWithJwtAuthentication(jwt, null,
+ ClientAuthenticationMethod.CLIENT_SECRET_JWT);
+ assertErrorCode(result, getErrorDetaisForJWTValidation().getFirst());
+ assertErrorDescriptionContains(result, getErrorDetaisForJWTValidation().getSecond());
+ }
+
@Test
public void testValidSecretJWTHS256_IssuerAudience_typeSetNotEnforced() throws Exception {
final List<String> ids = new ArrayList<>(clientIds);
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IntrospectionFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IntrospectionFlowTest.java
index 5e1cdca4..19b56059 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IntrospectionFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IntrospectionFlowTest.java
@@ -93,6 +93,7 @@ public class IntrospectionFlowTest extends AbstractOidcClientAuthenticationFlowT
removeMetadata(storageService, clientIdEndpointAudienceDisabled);
removeMetadata(storageService, clientIdRequireClientAuthenticationJWTType);
removeMetadata(storageService, clientIdActivateRevocationCondition);
+ removeMetadata(storageService, clientIdExtraAudienceDisabled);
}
@Test
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/PushedAuthorizeFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/PushedAuthorizeFlowTest.java
index 2465e7c7..ac83b90b 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/PushedAuthorizeFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/PushedAuthorizeFlowTest.java
@@ -107,6 +107,7 @@ public class PushedAuthorizeFlowTest extends AbstractOidcClientAuthenticationFlo
removeMetadata(storageService, "mockClientIdDPoPAccessToken");
removeMetadata(storageService, clientIdEndpointAudienceDisabled);
removeMetadata(storageService, clientIdRequireClientAuthenticationJWTType);
+ removeMetadata(storageService, clientIdExtraAudienceDisabled);
}
@Test
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RevocationFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RevocationFlowTest.java
index 371c51e0..b128e127 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RevocationFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/RevocationFlowTest.java
@@ -90,6 +90,7 @@ public class RevocationFlowTest extends AbstractOidcClientAuthenticationFlowTest
removeMetadata(storageService, clientIdDPoPProofEnforced);
removeMetadata(storageService, clientIdEndpointAudienceDisabled);
removeMetadata(storageService, clientIdRequireClientAuthenticationJWTType);
+ removeMetadata(storageService, clientIdExtraAudienceDisabled);
}
@Test
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
index 71334a81..e2a48be1 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
@@ -142,6 +142,7 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
removeMetadata(storageService, clientIdEndpointAudienceDisabled);
removeMetadata(storageService, clientIdRequireClientAuthenticationJWTType);
removeMetadata(storageService, clientIdActivateRevocationCondition);
+ removeMetadata(storageService, clientIdExtraAudienceDisabled);
}
@Test
diff --git a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/relying-party.xml b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/relying-party.xml
index 37acf8fc..367270e9 100644
--- a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/relying-party.xml
+++ b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/relying-party.xml
@@ -94,6 +94,17 @@
</list>
</property>
</bean>
+ <bean parent="RelyingPartyByName" c:relyingPartyIds="mockClientIdExtraAudienceDisabled">
+ <property name="profileConfigurations">
+ <list>
+ <bean parent="OIDC.SSO" p:responseModes="fragment" p:requireSingleJWTAudience="true"/>
+ <bean parent="OAUTH2.Token.MDDriven" p:requireSingleJWTAudience="true"/>
+ <bean parent="OAUTH2.Introspection.MDDriven" p:requireSingleJWTAudience="true"/>
+ <bean parent="OAUTH2.Revocation.MDDriven" p:requireSingleJWTAudience="true"/>
+ <bean parent="OAUTH2.PAR.MDDriven" p:requireSingleJWTAudience="true"/>
+ </list>
+ </property>
+ </bean>
<bean parent="RelyingPartyByName" c:relyingPartyIds="mockClientIdRequireClientAuthenticationJWTType">
<property name="profileConfigurations">
<list>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list