[java-idp-plugin-oidc-rp] branch main updated: JOIDCRP-75 - Improve header type parameter of client authentication JWTs

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=dd24832f0e96b3971c70b2870cdc0fcaf1d6b54c

The following commit(s) were added to refs/heads/main by this push:
     new dd24832  JOIDCRP-75 - Improve header type parameter of client authentication JWTs
dd24832 is described below

commit dd24832f0e96b3971c70b2870cdc0fcaf1d6b54c
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Tue Jun 17 09:47:22 2025 +0100

    JOIDCRP-75 - Improve header type parameter of client authentication JWTs
    
     - Revert default header type to JWT, inline with the default for
    audience reverting to the existing behaviour in
    https://shibboleth.atlassian.net/browse/JOIDCCONF-8.
    
    https://shibboleth.atlassian.net/browse/JOIDCRP-75
---
 .../rp/impl/InitializeOAuth2ClientAuthenticationMethodHandler.java   | 5 +++--
 .../impl/InitializeOAuth2ClientAuthenticationMethodHandlerTest.java  | 3 +++
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationMethodHandler.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationMethodHandler.java
index fb29d54..43bc7a5 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationMethodHandler.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationMethodHandler.java
@@ -32,6 +32,7 @@ import org.opensaml.profile.context.navigate.ParentProfileRequestContextLookup;
 import org.slf4j.Logger;
 
 import com.nimbusds.jose.Algorithm;
+import com.nimbusds.jose.JOSEObjectType;
 import com.nimbusds.jose.JWSAlgorithm;
 import com.nimbusds.jwt.JWTClaimsSet;
 import com.nimbusds.jwt.SignedJWT;
@@ -459,8 +460,8 @@ public class InitializeOAuth2ClientAuthenticationMethodHandler extends AbstractM
         
         String jwtType = profileConfiguration.getClientAuthenticationJWTType(PRC_LOOKUP.apply(messageContext));
         if (jwtType == null) {
-            //default to 'client-authentication+jwt' see RFC 7523
-            jwtType = "client-authentication+jwt";
+            //default to JWT, another option would be 'client-authentication+jwt' from RFC 7523
+            jwtType = JOSEObjectType.JWT.getType();
         }
         
         try {
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationMethodHandlerTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationMethodHandlerTest.java
index 98a80ef..663d6b7 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationMethodHandlerTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/InitializeOAuth2ClientAuthenticationMethodHandlerTest.java
@@ -114,6 +114,7 @@ public class InitializeOAuth2ClientAuthenticationMethodHandlerTest extends Abstr
     @Test
     public void testInitialiseClientSecretJWT_Success() throws Exception {
         partyConfig.setTokenEndpointAuthMethod("client_secret_jwt");
+        partyConfig.setUseTargetedEndpointAsJWTAudience(true);
         
         final SecurityParametersContext secContext = new SecurityParametersContext();
         final SignatureSigningParameters secParams = new SignatureSigningParameters();
@@ -155,6 +156,7 @@ public class InitializeOAuth2ClientAuthenticationMethodHandlerTest extends Abstr
     @Test
     public void testInitialiseClientSecretJWT_TokenEndpointURL_Success() throws Exception {
         partyConfig.setTokenEndpointAuthMethod("client_secret_jwt");
+        partyConfig.setUseTargetedEndpointAsJWTAudience(true);
         
         final SecurityParametersContext secContext = new SecurityParametersContext();
         final SignatureSigningParameters secParams = new SignatureSigningParameters();
@@ -231,6 +233,7 @@ public class InitializeOAuth2ClientAuthenticationMethodHandlerTest extends Abstr
     @Test
     public void testInitialisePrivateKeyJWT_Success() throws Exception {
         partyConfig.setTokenEndpointAuthMethod("private_key_jwt");
+        partyConfig.setUseTargetedEndpointAsJWTAudience(true);
         
         final SecurityParametersContext secContext = new SecurityParametersContext();
         final SignatureSigningParameters secParams = new SignatureSigningParameters();

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.